I emailed a known e-mail address for my local telecommunications/internet company about a complaint with their service. It appears the person I emailed forwarded this to somebody else in their office and I got an email from them - asking for my four-digit pin, either by email or by the provided phone number.

Now, technically, this email is in response to one of mine but I cannot verify it.

My goal is to provide them the identity verification they desire without engaging in multiple back-and-forth communications with this email address or having the original person I emailed re-forward something else.

One thing I was thinking was this:

  • Call their general customer service number, provide verification to them, and have them put in the notes on my account a randomly-generated eight-character (or whatever) code/word.

  • Reply to the pseudo-unconfirmed email address with that word.

I'm trying to determine if this leaks information or not. It certainly does not leak the pin number itself, but is there another exploit this opens up?

  • 1
    I suggest you call there customer service and ask to speak to the guy that sent you the email - that way you can verify that the email was sent by their employ and then you can supply him with the 3 digit code... – Bubble Hacker May 24 '16 at 8:45
  • The biggest issue there is that this is the executive escalations department, so that's five tiers above the grunt in India on the phone. – iAdjunct May 25 '16 at 14:05
  • But customers always comes first so if you explain to them your story I am sure they will help you... – Bubble Hacker May 26 '16 at 3:34
  • How many tier-1 (or even tier-2) techs even understand why you shouldn't email a pin, let alone a way to get around it? Furthermore, I actually tried this. Took 10 minutes to convince the guy in India to just put a note in my account. He, however, failed to make a note that he actually authenticated me, so it was all for nought. – iAdjunct May 26 '16 at 3:42
  • I see. Well do you have insurance on your payment method to the company? If you do, then you can take the chance of sending the pin by email if there is really no other choice... – Bubble Hacker May 26 '16 at 3:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.