you called me - and asked for security details - this is NOT secure

[#1]

What a lot of fuss over a trivial matter. If it's a cold call then you phone them back on their normal telephone number. If it's a call responding to your request then I can't see any problem giving 2 letters of the password and then after the call change the password. Users should be changing their password regularly anyway.

[#2]

I'm more concerned of the practise of companies and government bodies taking photocopies of passports and driving licences.

[#3]

Quote from: itsme

If it's a cold call...

Exactly, itsme. That's the essential point; in the OP's case it was hardly a cold call.
I used to get regular cold calls from my credit card company, offering 'fantastic insurance offers' etc. At least, I'm pretty sure it was them, but they expected me to disclose some security detail to prove who I was. I asked them to prove who they were first, but they said they couldn't disclose any of my information until they were sure it was me. Impasse! 
I don't get any sales calls from them now! 

[#4]

many years ago now - before we were more aware of security - I did a stupid thing.
I recveived a phone call from my credit card bank - they offered a new service - and asked for my bank details and like a fool I gave it.
Not any more I won't deal with incoming calls like that - and most such users have numbers withheld or an 0870 / 0845 number.
People like BT / PN would be doing us all a great service if we could block calls from certain numbers - by logging onto our member pages and having a table where we could add and delete numbers that were to be blocked. And not charge a fortune for the service - like £2 a month - it should be part of the basic service in this day and age.

[#5]

I like that idea mal. If PN offered it and BT didn't, it might just persuade me to jump ship for phone service.

[#6]

Surely the simple way to verify the caller is from Plusnet is to give the wrong two characters, if they are accepted put the phone down, if told they're incorrect you know the caller knows so is from Plusnet.

[#7]

Whatever is used - don't use full name and address, date of birth - mothers maiden name , like many organisations do - that information is far too easy to find.

[#8]

Quote from: jac2285

Surely the simple way to verify the caller is from Plusnet is to give the wrong two characters, if they are accepted put the phone down, if told they're incorrect you know the caller knows so is from Plusnet.

Neat - I like that.

[#9]

Just to add my 2 cents worth - PN have asked me for the last 2 characters of the password for verification - I remember being surprised at the time!
Maybe the point is valid

[#10]

Just for information: Bruce Schneier (http://www.schneier.com) regularly blogs about this sort of problem.

[#11]

Maybe it should be two random charachters (as much as I hate that sort of thing have to stand and count charachters on fingers) which would make it harder to guess the password through repeated phone calls?
I remember when I moved and went in to a branch of Halifax to change my address, they asked (despite teh fact I had the bank card, passport etc.) needed a couple of questions about my account including whether I knew of any direct debit's and what date/value they were for etc. as well as a couple of other questions too - so questions like 'What's your billing date?' might help?
Alternatively, ask the person that's phoned up what the details might be, as then they should be able to tell you - what's the last two characthers of the Sort Code my DD comes from, for example?