You have two big issues here. Let's get the easy one out of the way:
No, they should not ask for your username and password
Since you said you contacted them through their on-website live support, one of two things was happening:
- Their website got hacked and you narrowly avoided giving your login credentials (and therefore money) to a hacker
- They have poorly developed support infrastructure and poorly trained support employees. If you gave away your credentials something bad may have happened, although you might have been perfectly fine.
Personally I'd probably go with #2 - if a hacker had taken over their website they would have had much more effective ways of collecting your credentials than waiting for you to open the chat and ask for your username/password.
Unfortunately many businesses don't understand the dangers of asking their users for their credentials. There are two main risks in doing this:
- Employees are a major source of trouble themselves, and so there is no guarantee that an employee won't steal from a customer if they are given username/password while doing their job, and see an account full of money on the other end.
- Regardless, it trains their customers that giving away username/password is okay, making them more vulnerable to future phishing attempts.
So: This is not safe. This is not reasonable. It is however somewhat normal (although shouldn't be). I would at least complain to their support and try to explain why this is such a bad idea, although don't expect them to take you seriously. I would probably try to find a new place to take my money. Onto issue #2
Using an easy-to-guess rule for password generation is not a great idea
I use a variation of the same password for every website that would be
pretty easy to figure out if one tried, because i thought no human
would ever see them and everything is supposed to be store encrypted.
This is a very bad assumption. Unfortunately passwords get leaked from websites all the time, and oftentimes in forms that allow hackers to figure out what the password is (presuming it isn't just in plain text, which still happens). As a result you should assume that your password will be seen by people, and therefore pick a password that is completely unique to each account. The best way to do that is with password managers. Obviously many people don't want to put forth the effort to use one, but at the very least if you have an important account (which this would be if it is protecting >$1,000 of your money), it should really have its own strong, unique password.