The caller is actually a fraudster, and they’re the ones who are about to commit the fraud, but they can’t do that unless their intended victim reads out the OTP (one-time-pin) that’s just been sent to their phone in order to authenticate the fraudulent transaction.