Tragically, this practice is not limited to Commonwealth Bank. I have had similar cold calls from Citibank and various telecom companies who all start out with wanting to verify my account details.

Funny enough, these companies' email policies also state that they will never request account or security details via email but obviously this has not carried over to how they interact with customers over the phone.