Customer Service can see all PlusNet account details, even my Password - Good??

[#1]

Hi all,
I have just been on the phone to customer service of PlusNet and the guy on the other end of the line asked for my first and last letters of my password. With this I asked, why you can see the whole of my password or just the first and last letter, which he replied he can see the whole password.
As I don’t know much about the privacy of my account and password (which I will now look into) I decided to ask the guy what privacy statements he has signed as discloser of information on our accounts, which he replied, this is solely done with trust based service. So basically he has signed no forms to agree by law that he will NOT give my details to anyone else. He is just trusted not too!
The information provided to people in customer service gives access to all of your PlusNet accounts and passwords, including email address's which means anyone that works there could access your PlusNet emails and any information within those emails. Not only that, but I know family members that use the same passwords for all sorts of accounts, so if you do use the same password as your PlusNet account people could potentially hack other accounts you have with the given information.
I work in IT and know how easy it could be for someone that has the knowledge to, apply the information viewable by support and potentially hack other accounts you may have providing you share user names and passwords across different internet accounts ie. Google, yahoo ect.
PlusNet have your PlusNet username, password, address, telephone number, browsing statistics, email addresses. And this is what I know of.
Last week I was a victim of internet fraud as my credit cards details were intercepted. There is some very complex and clever software available to do these types of jobs, and they are very effective with people making a lot of money from internet fraud.
I just wanted to stress the above as I was very shocked to hear the information the customer service rep can see. Just to warn all people, you should use a different password for every account you have anywhere on the internet, and you should change them regularly.
This is not a dig at any member of the customer service team but I know how easy it is to impersonate accounts if it put into the wrong hands.
Please correct anything in the above, you feel may be wrong and I’d like you hear you views.
Stefan

[#2]

Quote

So basically he has signed no forms to agree by law that he will NOT give my details to anyone else. He is just trusted not too!

Not quite accurate, the contract you sign when employed at Plusnet *does* cover this.
The viewing of customer passwords is also audited, you have to specifically click a separate link which then provides the password so we can always see who has looked at those details on accounts.
TBH it would be near impossible for us to do our jobs effectively without knowing this information, alot of the things we have to test involve checking mailbox authentication, dialtest etc. So without the password we wouldn't be able to do this.
Hope this clears it up and puts your mind to rest a bit.

[#3]

Quote from: Chris

Not quite accurate, the contract you sign when employed at Plusnet *does* cover this.

And the person in question clearly hadn't read or fully understood his contract, thereby making it a worthless document from this perspective.
Had the person in question fully understood their contract of employment, they would have been able to set the OPs mind to rest with ease.
Worrying that this was not the case.

[#4]

I was very annoyed recently when  i realised that not only do Plusnet customer service staff have access to complete passwords, but they also tell you your password over the phone!! so much for security!! My trust in Plusnet is now zero & i'm thinking of moving to another isp.

[#5]

Hi,
Any other ISP would also tell this after you have proven (normally with billing details, etc) that it is certainly your account.
Please believe me that this is perfectly normal practice.

[#6]

And I certainly would have far less trust in call centres based in Mumbai and the likes