How is that possible?

The procedure is:

1. Kid tells password to parent in person. 2. From then on: when kid calls parent, if kid requests anything sensitive, parent ask for the password, and kid must provide it. 3. Password is never mentioned over the phone in any other situation.

How would anyone be able to extract the password from the kid?

Hilarious. “Hey, someone who says they’re you is calling me. Remind me again what the password is that they’re supposed to say?”

“Grandma the password is ‘Integra’ but I can just tell you now, it’s not me calling you, it must be a sca—“

“Thanks got it byeeeeee” <scammer calls grandma>

But kid knows not to give password to a caller.