5

I tried to initiate an online chat with customer service of a company I am trying to do business with this weekend, but before they would answer any of my questions they requested that I give them the 4 digit PIN associated with my account. For all intents and purposes, this is my password, as this along with my e-mail address is all that is required to log in to my account and do whatever. (Yes, the fact that it is only 4 numeric digits isn't particular reassuring either!)

I responded that I wasn't comfortable giving this information out, seeing as how it was pretty much a standard security practice to never give your password to anybody, but they pretty much refused to talk to me if I did not give them this information. Seeing as how when I created the account I also had to give a "security question" (e.g. what was the name of your first pet, that sort of thing) I was also puzzled as to why they wouldn't just ask for that.

Am I overreacting, or am I justified in refusing to provide this information? For what it's worth the only other way to talk to this company is by phone, which is very inconvenient. (Update: Not that that is particularly relevant, but from what they said it sounds like they would require my PIN to talk on the phone too.)

3
  • 3
    I would just like to add here that you should never answer a "security question" with anything but another random string or sentence and use it much like a second password.
    – d1str0
    May 23, 2016 at 17:20
  • @d1str0 Yeah, and in this case it's funny(?) having a security question which is actually much more secure than the actual "password". My favorite though is when they allow you to make up your own question and mine will be something like, "What is a random string of bytes?"
    – Michael
    May 23, 2016 at 19:08
  • GoDaddy does this too May 31, 2020 at 12:40

3 Answers 3

8

Your action is justified from me. I have never been asked from any major and respectful company such information, neither for a service, nor even for account recovery. Send a message to the official support team and see if these info are actually needed if this thing causes you lots of inconvenience. But be aware of this - you might be scammed.

6
  • I would love to send a message to the official support team, but they don't provide any such contact info...
    – Michael
    May 23, 2016 at 16:04
  • Then forget about it. I am pretty sure it is a scam May 23, 2016 at 18:27
  • Unfortunately I can't, because it appears that without actually talking to somebody on the phone (and presumably giving them my PIN) I can't even cancel the service I ordered.
    – Michael
    May 24, 2016 at 14:43
  • well as an update, I can at least change my PIN after I give it to them.
    – Michael
    May 24, 2016 at 15:37
  • 1
    Well... If it is very important for you to happen, go for it. Make sure it doesn't let anyone use your credit card or something. I really can't understand what sort of thing you are dealing with. Share the name of the company if you want to take a look. I am very curious... May 25, 2016 at 20:44
2

I totally agree with the answer by @ChrisTsiakoulas that your action is justified. However, sadly, this practice is not quite as uncommon as we would all like. I intend this answer to add a bit more colour to the real-world situation with such practices.

I have come across the exact scenario you describe, although it was with a "proper" password (referred to as a password and allowing letters and numbers) rather than a strictly-numeric PIN.

Having created the online account and chosen a password that seemed to be required only for that online log-in - I was also required to provide that password verbally on the phone to a human in order to authenticate myself before anything could be done with my account.

This was with PlusNet, a major (popular, big-budget, well-advertised) ISP in the United Kingdom. I was as surprised as you to be asked for my password: after further questioning the customer service operative, I found out that they were able to put a note on my file to ask me for my security answer instead of my password. However, at the same time I found out that whenever I called, the operative would be viewing my full password in plain-text on their screen, before asking me any kind of authentication question.

I raised quite a storm about this, including a formal complaint via their complaints procedure, and referring them to the UK's personal information "watchdog", the ICO. My argument being that such an insecure process massively jeopardised the security of the personal information they held about me (including bank details, since I pay them via Direct Debit). However sadly both the internal complaint and my ICO 'case' resulted in the other party failing to see or acknowledge that there was anything wrong with this situation. It seemed that in UK law at least, this practice is entirely OK and not at odds with our data protection legislation.

Note, I've not had to telephone PlusNet in a long time since (although I do still use them) so I can't confirm if this is current policy. It is possible they've changed practices since my complaint, regardless of the fact my complaint itself was fruitless.

0

Unfortunately, even today there are some major companies where a human customer service agent asking you (whether via chat, phone, or other means) to tell them your PIN, password, or passcode is a regular practice.

To take one very prominent category of these situations here in the U.S., when you call customer service for one of the big four national mobile carriers it is not at all uncommon for a live, human representative to ask you to tell them your PIN as part of the process of authenticating that you are in fact the account holder. Moreover, some of the major carriers will even require you to tell your PIN to a representative when you go into one of a carrier's physical stores and get face-to-face customer service. To learn more about how & when you might have to provide a PIN to a human agent for a U.S. carrier, you might look at AT&T's policy. on the subject. Or T-Mobile's. Or Sprint's. The point is that this is still a common customer service procedure in this very, very important example industry. (No doubt true in some others as well.)

Now, to be clear the problem here certainly isn't that the companies require the customer to provide a PIN to access his or her account or make changes to their service. In fact, requiring a PIN is a far, far better approach than just allowing a putative account holder to authenticate with static personal information (like the last four digits of their social security number) that can today be gathered pretty easily from public or illicit sources. The problem, as you identified, is how the customer must provide the PIN. Now, most major companies these days in most major industries do things the right way: the customer enters their account number (or other user identifier) and their PIN into some kind of secured computerized system--whether via touchtone phone entry to a customer service call system, a secure page that a customer must authenticate with on a web site, or a kiosk or PIN pad for in-store situations-- before they are then sent to a human support agent. The PIN/password/passcode/whatever should not be provided to a support person directly. Period. But, alas, in 2016 we still can't say that all major entities one might deal abide by that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .