yeah someone that gets paid a lot needs to talk to someone whos pay depends on implementing that IT consultants directives.

relaying security codes by voice is how the bad guys do it, dont train your users to think its normal.

its probably not a bright idea to have your phones camera pointed at your screen while 2FA-ing or password resetting, or else someone will watch you login, and will see your codes, and use automation to authenticate with your digits faster than you can move a cursor and click.