My personal email address is a simple one. Many strangers on the Internet think it’s theirs, so they put it on their bank accounts, their cell phone service plans, their social media accounts, their electric service, &c. These companies – without checking that the address is good – blithely send me these people’s address, bank balance, SSN, names of their children on their cell plan, call history, and so on and so forth.
Often I’ll do a password reset via email and then change the email address on the account. Or if it’s a throwaway (like, dating) account then I’ll just close it. But sometimes I can’t take over the account, so I’ll contact a company’s support to ask them to take my email address off their customer’s account.
It’s kind of hilarious when the company then gets all concerned about security. “What’s your date of birth?” Um, my DOB isn’t useful to you, and I have no idea what your customer’s DOB is. “We’re sorry, we can’t make any changes to the account without verifying your identity.” So you’re going to keep sending me your customer’s private information? Okay then.
Right now I’m going through this with an Australian cell phone service provider. I tagged them on X.com, but they doesn’t accept private messages there, so they asked me to PM them on Facebook. Which I did, but they let me know that any email addresses or account information I send to them are redacted before they can read it. “We can file this as a complaint,” they said. “We will send you a secure form asking for more information.”
Problem is, their secure form is time-sensitive; I have to submit it within 30 minutes of when they send it, And Australia is 14 hours ahead of my time zone, so they sent this form to me in the middle of the night here, and I’m not waking up for that.
So I told them: “You may want to contact your security team and let them know that a non-customer has access to your customer’s account information; they may have a way to fix it without needing us to coordinate on a form that has a limited time window. Otherwise, don’t worry about it; I’ll wait until I receive more information in your customer’s emails that lets me take over their account and handle the problem myself.”