I'm filling out tax information. The accountants out-source the survey collecting the tax info to another company. Seems fair enough - I'd rather have computer experts handle the technical implementation of my information's security than have tax accountants trying to do it.
Problem is that when I pause work on inputting the info, the survey company emails me a link to return to the survey. No password involved at any stage. Anyone with the link can access the survey.
Obviously someone malicious could read the email. Or maybe I might use a browser that stores the URL. Or since the URL only has 5 random characters in it, it's probably possible to guess a random URL and get into someone's survey after enough tries.
But if I were to reach out to these companies, what should I say? Whenever I see something like this (plain text emails of passwords in particular), and complain, people just ignore it. So can anyone advise how to highlight the vulnerability in a way that gets people to take it seriously?