I just refused to give my credentials to a phone call operator who called me. and I wonder whether I did the right thing.
Background. My cellphone operator (call them Alpha) uses a simple authentication, it's a 4-digit pin. When working in the web interface, one uses the whole pin. When calling Alpha's service centre or speaking to their clerk face-to-face, they ask for 2 digits of the pin.
Situation. I was called from a land-line number in my country. The lady said she's an operator from Alpha with some offers to me. She told me to authenticate myself and asked for 2 digits of my pin. I refused because I feel this could be a scam. She said goodbye (in a polite way) and we ended the call.
Possible exploit (I think). She has the Alpha service centre on another phone (it's possible to contact them on your account from a phone that's not yours), the system is this "speaking to computer". The system asks her for 2 digits of my pin, she asks me for them, I tell her and she gains access to my account.
Now, I don't think you can actually do much damage in my account, and especially get any profit from such damage. But you never know, maybe someone wants to revenge on me and cancel some of my products causing me trouble, or buying extra products causing me unwanted expenses.
Am I right that it could be a scam attempt?
Assume it was really Alpha calling me. What should I or Alpha do to remove this problem? I tried to google the number, no results from Alpha's website confirming it's them; I don't think I can do much more.