A lot of banks I have dealt with require the customer to enter their customer number, internet banking password (or phone password) and date of birth all via the phone keypad, prior to being connected to a staff member. Each of these individual details are followed by the # symbol.
After entering these details, the customer can perform most actions (e.g. transfer money or change personal details) without any further verification procedures. Depending on which phone you use, these numbers remain on the screen for the remainder of the phone call.
Additionally, when transferring money via this method, the bank no longer requires 2-step authentication, unlike when transferring money via the banking app or website. This is the same regardless of whether you call from the number linked to the account, or an entirely different number.
This seems a lot less secure than using the bank app or website. But how much of a security threat does this present?
In the context of a smartphone - How easy would it be for malware/spyware/keyloggers to extract the numbers separated by the #, and therefore gain access to the associated bank account via phone banking?