I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account dashboard. I clicked "forgot password" and they prompted me with 5 questions. First Name, Last Name, last 4-digit SSN, birthday, and zip code. All information that is easily acquirable if trying hard enough, not to mention all information that is included in their periodic emails about payments. Upon typing in the information the site responds saying I have been authenticated and gives me my password in plaintext.
So now not only is it incredibly easy to retrieve lost password details, they dont even send it to your email they just display it on screen, on top of that they store the password in plaintext in the database. This is an account that has details of my multi-thousand dollar loan as well as my bank details for auto-payments. Fortunately the one detail not given is my username, which is my full SSN, so that is the last thread of security; however, if they store passwords unhashed I'm sure my SSN is not either, making this even worse.
So my question is, given that this is a loan that I can't just up and leave is there/what are any precautions or steps that I can take to make this potentially more secure? Would it be worth emailing them and badgering them to upgrade their security or should I just pay as quick as possible and get out? If I do warn them, what types of threat should I say they are vulnerable to in hopes to scare them into a patch?