I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account dashboard. I clicked "forgot password" and they prompted me with 5 questions. First Name, Last Name, last 4-digit SSN, birthday, and zip code. All information that is easily acquirable if trying hard enough, not to mention all information that is included in their periodic emails about payments. Upon typing in the information the site responds saying I have been authenticated and gives me my password in plaintext.

So now not only is it incredibly easy to retrieve lost password details, they dont even send it to your email they just display it on screen, on top of that they store the password in plaintext in the database. This is an account that has details of my multi-thousand dollar loan as well as my bank details for auto-payments. Fortunately the one detail not given is my username, which is my full SSN, so that is the last thread of security; however, if they store passwords unhashed I'm sure my SSN is not either, making this even worse.

So my question is, given that this is a loan that I can't just up and leave is there/what are any precautions or steps that I can take to make this potentially more secure? Would it be worth emailing them and badgering them to upgrade their security or should I just pay as quick as possible and get out? If I do warn them, what types of threat should I say they are vulnerable to in hopes to scare them into a patch?

If you are concerned about the privacy of your password and thus your account (which should be the case), you should try to educate the customer service. The developer FAQ from the public shaming project for this kind of recklessness lists a few good points and is worth a read.

Also, you should point out that you feel insecure and lose trust in the company and will make them liable for any problems that stem from this no-go.

You should also document that behaviour and try to get a written quote on their point of view if they do not see a reason to fix this. Thus, if any problems arise, it will make the whole thing easier for you from a legal point of view.

Besides that, by submitting the site to plaintext offenders, you will provide a third-party point of view, which might help your case.

Also, I assume you use a secure unique password for that site and hopefully have always done so.

If not, treat this as a regular leak, changing all your passwords (and on that occasion, make sure to use unique passwords for each service)
