Security Issue with Lycatalk

Lycatalk is a popular international calling service offering calls to different countries at a competitive rate. I have been a fairly newish but a happy customer – so far.

But today morning I was on the phone with their customer services and was going through the usual identity checks. I was quite surprised to hear the support person ask me to verify my account password! When i asked him whether he could see my account password, he replied he could (!?!). He was actually able to confirm my correct password for me?

Now, given the fact that most people tend to have the same password for almost all their accounts, it is very disturbing to know that someone can see you account password AND have access to the rest of your personal details such as address, card numbers, etc.

This is also generally against standard security practices. Thinking for the worse, what is to stop a rogue/ex employee using your details on just about any other popular services like Gmail, facebook and even your bank? I will leave the possible consequences to your imagination :-(

Here are a few suggestions for fellow Lycatalk customers:

1. IMMEDIATE: Please change your Lycatalk password to something that is NOT associated with other accounts.
2. Consider dropping Lycatalk an email complaining against this situation (i am still trying to find out an email id to do this, the only one I have at present is -- info@Lycatel.com)
3. When asked for the account password, REFUSE to provide this and ask to be authenticated using alternative means (Cardinal rule of phone-based support - NEVER provide your password to anyone else - EVEN the service provider employees).
4. If none of the above works, consider switching (anyone has any possible alternatives?)

At the time of writing this post, I have yet to speak to anyone else from Lycatalk or email them about this matter. The last person I have spoken to has been the customer support agent today.