That pretty much covers it. We telephone them in house on their extension number and there's only 60-ish employees so we know their voices. Externally they have to call back.
In enabling my Gmail account to use 2 factor authentication, Google required me to hand over my text-enabled cell phone number, and they texted me a code which I was required to input in a form. Similar to having the client call you back, but this can be automated.
This came up in another thread some time ago, and it was suggested that one very simple way to do this is to have the person call you back.
Ultimately though there is no real solution to this problem except meeting the person face to face.