2

I make monthly payments to a website/company who insecurely stores my information. These are in the form of loan payments, so I don't know if I can change who I pay to.

I asked for login assistance one-day and they sent an email saying they logged into my account fine and that this was my password: example123. Additionally, my bank account is stored on the account showing all of the digits of the account rather than last 4.

Is there anything I can do to protect myself?

Improve this question
  • Did they send your existing password in plain text, or a new one? For the latter, that's about the best they can do. If the former... (and given the other comment), it implies that they logged on as you, which is potentially worse ("Yes, I can see here that 1 week ago you logged in and turned off automatic payment. Now, about that late fee...."). For protecting bank info, get a brand new savings account that you transfer money into a day or so before they ACH it out. That protects the rest of your account, although transfers are more difficult than that, usually. – Clockwork-Muse Feb 20 '19 at 22:44
  • You can contact that company and suggest they change it. Perhaps contact the regulators in your jurisdiction for privacy and/or financial questions. – Natanael Feb 20 '19 at 22:46
  • They logged in as me with my existing password sent in plaintext. I currently have my checking account connected which I keep low on purpose. I will go look up some regulators. – spitfire21 Feb 20 '19 at 23:05
  • 4
    Consider looking on PlaintextOffenders if they have an entry. – forest Feb 21 '19 at 3:56
  • 1
    Print out every article on password storage you can find, bind them into a book, and beat them with it until they learn what a hash is – Redwolf Programs Feb 21 '19 at 4:01
5

What you can do, is to reduce the risks to yourself, with reasonable means. By order of importance and least effort:

First, use a unique password for this company, do not reuse it elsewhere, even in part. That way, when the company leaks its database, your other accounts will stay safe.

Second, apply this advice for every website, because you never know, they could be insecure, too. Use a password manager to remember all those passwords; it can even generate new ones for you.

Third, as much as possible, limit the amount of identifying information to send them to the strict minimum. For example, use a dedicated e-mail address, or a redirection to your main address. You can open an (online) bank account just for them.

Fourth, call your bank and your debit/credit card provider (Mastercard, Visa...) to inform them that this company does not store your banking data securely and that you suspect they are not compliant with local laws and PCI-DSS. Tell them you are afraid this put your money at risk. Maybe they will do something, but most probably not: they might just let their insurance cover the costs in case of an incident. But at least you will have done what you can.

Improve this answer
  • I am going to follow these steps. I already do step 1 & 2 but will create a new email and create a new bank account for those payments. Additionally, I will contact my bank and inform them that this company does not care about PII. – spitfire21 Feb 21 '19 at 16:48
0

If they sent your existing password in plain text it means they have no password storage encryption whatsoever and they are practically open to credential theft at any time. It is their problem, not yours.

If they reset your password, it may mean at least they use a sort of encryption to store it, which is good.

There is nothing you can do in any case; it's 100% their problem. I have seen similar situations in many banks.

Improve this answer
  • 1
    I mean, it is not so simple as it is 100% their problem. Because it is his problem as well, his PII and banking information is on the line. Obviously they have to change this, but this does imply you have no responsibility over defending your PII. – Kevin Voorn Feb 21 '19 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.