today's security fail...

[juliet]

Send email to TMobile re billing. (By the by, my preferred method of contact is stated RIGHT THERE as being email, but no matter.)

Receive phone call from TMobile 5 min later. Hello, this is about your email. Great. Can you please give me your password? No, because I'm not prepared to give out my password to someone who calls me claiming to be from TMobile, because hey, how do I know who you are?

This does not fit the script. We go through various versions of "but we have to go through security before talking about your account" and "yes I am from TMobile, it's about your email", before I finally say "look, can you just email me about it? thanks".

FAIL. Now, can I be arsed with emailing them to complain about their poor security procedures?

I might have phoned them back, but it was an 0845 number & the whole point of the complaint was that they're charging me outside of my plan for 0845 numbers.))

Comments

[flick]

The former, I suspect: I've pointed it out many times to my bank, and been told that it's not a security risk. See also Verified by Visa, the security on which can generally be overcome with that fantastically rare set of data, ones account number, sort code and date of birth.

I'm now rather resigned to it, and find the most annoying thing to be the fact that if I ring back immediately (as they request) the new person I speak to is invariably locked out of my account because the first person is still logged into it....