Authenticating people over telephone

Never seen this being done before.

I contacted a Bank of America representative over the telephone, and they needed to authenticate me before we could get down to business. I was asked my name, and was then asked to confirm a series of questions. I was not asked to state these facts myself - they stated it themselves, and asked me to confirm it.

Silly way to verify a person's identity, one would think. Anyone could pass of as me, if they had my name and my account number - and if they simply confirmed every detail that the CSR gave them. However, the CSR did make one minor mistake while stating the details - my phone number was off by one number, and I corrected them promptly. Looking back, it is quite clear that the mistake was deliberate. In this way, I did not say out any of my personal details out loud (which would have been terrible in public), and I pretty much authenticated myself by correcting one random mistake that they chose to make.