Every year an automated password reset occurs on a VPN account that I use to connect to the institution's servers. The VPN accounts/passwords are managed by the institution's IT department, so I have to send an email every year to follow up with the account controller in order to get the new password. This always ends in a phone call, because their policy is to not send passwords through email.
I have a vague understanding of why sending passwords through email is bad, but honestly I don't understand why telling someone a password over a phone would be any better. Assuming I have a 0% chance to change their policy (I really have no chance), why would telling someone a password over a phone call be more secure than email?
I am primarily focused on the ability for phone/email to be intercepted by a third party, but @Andrew raised a good point about the permanency of email.
There is some great information in this Q/A, but that question is about the most secure way to send login information, while I'm specifically asking about phone call vs email security.