This isn't a literal transcript of the conversation, more like what was going on in my head vs. what they said ;) Of course I was nice to them in explaining that I have a ton of virtual phone numbers and really don't know which one I used, etc.

I would not think CSR would actually know that phone is not a secure channel. I bet they are taught it is.

It is still more secure than not using a second factor at all. Stealing a phone number is more work than not having to do it.