security with Sprint

[cos]

A couple of weeks ago, I called Sprint customer service from my Sprint cell phone to ask for help with something (I couldn't get Internet services, it turns out their network was partly down in the east coast for a while). The service rep who answered asked me for my cell phone number, which I gave him. Then he asked me for my password. I assumed he meant my telephone customer account code that I'd given them to verify my identity when calling in. Actually, I didn't remember if I'd done that with Sprint, but I assumed they ask everyone to do that, and I knew what code I would have given them, so I gave him that code. He typed for a few seconds and then told me:
"That's not your password, but I do recognize that as your account code. Your password is XXXXXXX [not the actual password]."
The password he had just read off to me over the phone, is the password I use to log in to the sprint web site. From that account, I can view my bills, change my service options, and it's linked to my bank account to let me pay bills online. I was not happy. I told him so.

We had a short conversation about the security implications of reading off people's passwords to them over the phone, especially over a cell phone, and about customer service using the same password as people use to log into their Sprint web accounts that are linked to their bank accounts. I asked him to pass my complaint on, after I explained it to him. Then I was ready to move on to the reason I had called, so I asked him to continue.

The next thing he asked me:
"What is the email address that you use as your username?"

(Sprint's online system uses an email address as the login username, and I use a sprint-specific email address there that I don't use for any other purpose.)

Comments

[zaph.livejournal.com]

the same thing happened to me when I suffered through Sprint's service. I asked "What if I didn't use the website? What would you ask for then?" which turned out to be irrelevant, since his response was "but you do use the website."

when I informed him that I absolutely would never speak my password over the phone, he said "Ok, we'll just reset it for you then."

they totally don't understand that the phone service system should be separate from the web system, at least as far as the entry points and front ends go. they should be able to access the same data, of course. (a problem that Verizon Wireless actually had with me - apparently the billing system the website accesses is different from the one the phone operators use, so you could get double billed if you're not careful. but at least they didn't ask me for my password over the phone)

[swashbucklr]

Sounds like it's time to stop using Sprint... I know I wouldn't put up with that.

WE

[cos]

Unfortunately, despite their flaws, Sprint's online service is significantly faster than any other provider, and I use my cell phone as an internet connection for my PowerBook more than I use it for any other purpose. Also, Verizon doesn't support the Treo, so of those providers that I can use with a Treo, Sprint has the best coverage. *sigh*

Can't the suck all be concentrated in a few companies, so the rest can be good?

[redheadedmuse.livejournal.com]

i think it's entirely possible that Sprint has the worst customer service I have ever encountered.

[cos]

In cell phones, the worst customer service I ever encoutered was Nextel Online, for the simple reason that I could never get through to talk to someone in under 40 minutes, and sometimes it took hours. That was okay while I was at work, working online, and I could just leave a speakerphone on hold at very low volume - and since my Nextel phone was work-related, it was okay to do that. But the few times I needed help from them when I wasn't at the office, it was almost pointless to try.

[sunspiral.livejournal.com]

Sprint's wretched customer service is what makes me want to switch cell providers. At one point I called up to register a complaint, and was told that they would only accept the complaint if I could provide them with my password. My reply was something along the lines of, "So, you have a lot of people who aren't your customers calling you up to tell you how badly your service sucks?" They didn't get it.