Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I make monthly payments to a website/company who insecurely stores my information. These are in the form of loan payments, so I don't know if I can change who I pay to.
I asked for login assistance one-day and they sent an email saying they logged into my account fine and that this was my password: example123. Additionally, my bank account is stored on the account showing all of the digits of the account rather than last 4.
Is there anything I can do to protect myself?
What you can do, is to reduce the risks to yourself, with reasonable means. By order of importance and least effort:
First, use a unique password for this company, do not reuse it elsewhere, even in part. That way, when the company leaks its database, your other accounts will stay safe.
Second, apply this advice for every website, because you never know, they could be insecure, too. Use a password manager to remember all those passwords; it can even generate new ones for you.
Third, as much as possible, limit the amount of identifying information to send them to the strict minimum. For example, use a dedicated e-mail address, or a redirection to your main address. You can open an (online) bank account just for them.
Fourth, call your bank and your debit/credit card provider (Mastercard, Visa...) to inform them that this company does not store your banking data securely and that you suspect they are not compliant with local laws and PCI-DSS. Tell them you are afraid this put your money at risk. Maybe they will do something, but most probably not: they might just let their insurance cover the costs in case of an incident. But at least you will have done what you can.
If they sent your existing password in plain text it means they have no password storage encryption whatsoever and they are practically open to credential theft at any time. It is their problem, not yours.
If they reset your password, it may mean at least they use a sort of encryption to store it, which is good.
There is nothing you can do in any case; it's 100% their problem. I have seen similar situations in many banks.
it is 100% their problem. Because it is his problem as well, his PII and banking information is on the line. Obviously they have to change this, but this does imply you have no responsibility over defending your PII.
– Kevin Voorn
Feb 21 '19 at 9:12
