I emailed a known e-mail address for my local telecommunications/internet company about a complaint with their service. It appears the person I emailed forwarded this to somebody else in their office and I got an email from them - asking for my four-digit pin, either by email or by the provided phone number.
Now, technically, this email is in response to one of mine but I cannot verify it.
My goal is to provide them the identity verification they desire without engaging in multiple back-and-forth communications with this email address or having the original person I emailed re-forward something else.
One thing I was thinking was this:
Call their general customer service number, provide verification to them, and have them put in the notes on my account a randomly-generated eight-character (or whatever) code/word.
Reply to the pseudo-unconfirmed email address with that word.
I'm trying to determine if this leaks information or not. It certainly does not leak the pin number itself, but is there another exploit this opens up?