I have an account on a major company website that has for some reason fallen under attack. Periodically over the course of the day I will get a text message from the company saying your password has been reset here is a temporary password please log in and reset your password. The first time this happened I brushed it off, second time contacted customer service who said they where unable to help. Its happened a few more times since then so I feel like whoever it is is making a concerted effort to break in. Since sometimes I am away from my phone and the temporary passwords are all always 8 digits, I'm afraid the attacker might brute force in if they are persistent enough.
What are some reasonable steps to take to try and add some security around the "reset your password feature"? Note, in this case changing my user is not an option as it must be telephone number.