You don't even really have to remember whether the question is exactly the one you asked (the calls always come at the wierdest times) since they pretty much validate themselves.

Me? I ask THEM to provide ME with an item of relevant info from my account, like my last transaction location etc. If they refuse because they can't give that away to someone they don't trust yet, I put the question back to them: Why should I give critical info to them when I don't know who they are. Banks insist on this way of working because it's easy for them and puts the onus on customers. If you divulge your info to a phisher who then calls your bank, gives the correct login info and empties your account, they can claim no fault.

If we are at a stalemate, I ask for an extension to call off their main, public 0870 number. I wouldn't trust any 0870 number they gave me unless it was verifiable publicly.

I can see 2-factor authentication like an RSA keytag becoming standard, where the bank calls you, tells you what your keytag should be reading, you give them some info to ID you, and then you are both happy.