SoCalGas' Password Policy Makes Passwords Pointless
We're not sure why a company would bother with offering a password feature on their customer accounts if they disable them without warning 3 months later as a matter of policy, but that's how Southern California Gas Company rolls. Does it really matter, you ask? It might if you're a victim of domestic violence.
One of their customers wrote to us:
I am in a domestic violence protection program, and must keep my private information (address, T#, etc.) confidential. One way I do this is by password-protecting my accounts, including my utility bills.
When I called Southern California Gas Company today to find out why it had not changed my mailing address to my protected one, I learned that the Gas Co. had "dropped" my password without notice — meaning anyone with basic information about me could access my account and, with good social engineering, get my street address and T#.
The first rep told me that the Gas Co. drops passwords "after six months," but then she noticed my account was only four months old. She told me that my password, apparently, was dropped after 90 days. She could not tell me why.
A second rep told me that all passwords are dropped after 90 days, but mine "stayed on for a little more than that" (120 days) "for some reason." Her supervisor confirmed that SoCalGas drops all passwords after 90 days, but does not notify consumers of this when they initially place passwords on the account. She said they are expected to notice it missing and request it be reinstated for another 90 days.
I called one more time to ask a third rep about this password policy. I did not give my account number, but said I was moving and wanted to know if I could password protect my account. The rep said "yes, no problem." And when I asked if it would remain intact while my account was active, the rep hesitated, first said "yes," then said "oh, but there's a policy that we drop it off after 90 days because we don't know how long you'll be living there."
This is terrible security procedure, and, in my case, places me in danger. It's unbelievable that a company would drop passwords from its customers' accounts without prior or current notification.
It wouldn't be as bad if Southern California Gas Company actually notified its customers when removing the password, or if their CSRs fully understood the policy and gave out the correct information when customers called in. Maybe they feel that it's sort of unnecessary—but as the customer above can demonstrate, there are certain situations where you really might want to keep your account info protected.
(Photo: Preconscious)
Post a comment
Comments:
Speaking as an IT security professional, this is not the appropriate way to manage passwords. Southern California Gas Company is creating more work for its staff by forcing customers to call every 90 days for a new password. Authentication questions and an automated password reset system would be a better idea, especially since most authentication systems have this feature built in.
@pecan 3.14159265: Exactly. A number of companies allow you to do exactly that. Not to assume too much about the OP, but I'll bet the reason they're in a domestic violence program already knows little details like her social security number and other standard validating identifiers. What they won't know is that to access the account, you have to say "catfish" or some other random passwordness.
@pecan 3.14159265: I think the OP just wants to be certain that her account is protected by more than security through obscurity. Without a password, which would only be known by her, her account could be accessed by anyone who knows her well, which a former spouse or partner would.
@AstroPig7: The OP never mentioned their sex, so I guess this could be a male. Damned missing edit feature!
Now that she knows she should just add a reminder to her calendar to change her password every 2.5 months
This is just bizarre.
It'd be one thing if their system forced their users to change their passwords every 90 (or 120) days or required them to confirm their info each quarter to keep it active.
But just dropping it? That's just nuts. Who thought that was a good idea? It makes no sense.
It's like they don't really want to have these accounts protected. Why wouldn't they at least tell people that this was going to happen?
@AstroPig7: I agree, though some companies use PINs, which can help as well, as long as you don't use your birthday, someone else's birthday, your address or your phone number. Or even 1234.
I think this policy is ridiculous and obviously potentially very dangerous. Besides domestic violence there could be many reasons someone would like a password to protect themselves.
I find it hard to believe that SoCal Gas has not had a situation where someone was harmed by this policy and then filed a lawsuit.
I think the trick here is for her to call in every day to have a password set on her account. She should be sure to explain, every day, that she is doing it out of fear for her safety, and is afraid that the gas company will drop the password.
This was designed by a consultant as a way to pad their bill........ shhhh don't tell anyone.
"We drop it every 90 days because we don't know how long you're going to be living there."
What kind of crap is that? What does that have to do with anything? If you pay the bill for it you're obviously still living there.
And if you're not living there anymore, the new customer comes and requests service in their name, and they present their lease/deed. Company removes old account and adds account for new customer. Tadaa, problem solved.
What's a T#?
@AstroPig7: Men are victims of domestic violence, too, but I don't think they are welcome in any of the domestic violence programs. I know domestic violence shelters turn away any victims who are male.
@henrygates: Some do and increasingly, some are beginning to offer a small section to men. However, the vast majority send them to homeless shelters, which may be more dangerous than the situation they're leaving. It's a sad fact.
Jezuz Fhist.
"don't know how long you're going to be living there"
How about checking the farking census. The majority of the USA population will live within 50 miles of their birthplace for their entire life and average 3 different residences during their lifespan.
Yes, it is 20th century data.
Most apartment leases are ONE year leases. Seems reasonable that people remain in place for at least one year. Wanna guess how many of those leases are renewed for a 2nd year? Locally, in a college town, better than 70% of the apartment leases are renewed for a 2nd year. I am willing to bet a months salary that the % is even higher in other towns.
Even with all the freedoms we enjoy in this country, most people are stable.... find a job and a place to live and stay there. Need a new job, find a new job, with the preference of being close to the current living arrangement so the person does not need to move.
"don't know how long you're going to be living there" is the stupidist farking comment I have heard in a long, long time.
PS: I bet the power company has data on the longivity of people retaining the same addresses. Wanna bet the average is better than 5 years?
This is a bit unclear. What type of access is being protected here? Online? Over the phone? Are they "dropping" it in the sense that they've left the account completely without a password? Or, have they invalidated the existing password--making the account inaccessible--and forcing customers to request new passwords on a regular basis?
If it's the latter, most IT pros are pleased with a policy of forcing regular password changes.
clients not staying more than 90 days Where is this?
Why protect you, if info already sold, your permanent record is becoming public knowledge and newspapers never seem to follow up and write a story if the charges were dropped so bad info is out there for ever, forever! Public record, forever!
@henrygates: Ages ago when I had more free time, I tried to maintain a list of shelters/programs for abused men in the US (amongst other lists of abuse resources). There weren't many and most of them were in large population areas, but there were a few.
However, some that specifically mentioned being gay-friendly got targeted for that alone and shut down or changed their names or whatever. I got an email from a guy who was sadly telling me to remove his shelter's info from my list because he had to shut down due to it becoming a place where nasty people picketed against gays in general. He said he'd let me know when he reopened elsewhere but he never did. :(
Time for a mass EECB by all SoCal Gas customers at the same time?
this isn't an online billpay passcode. It's an oral password you give to Reps of SoCalgas over the phone or when going to an office center. I have them setup on my cable bill and on my Sprint account. This password is different from the password I use to access those accounts online.
@kaceetheconsumer: Having an acquaintance who is male and a victim of domestic abuse, I called local organizations trying to locate support groups, as they already have a safe place to stay. The ones in my area don't even offer support groups for men.
@Persistence: That's truly sad, because men do end up on the wrong end of domestic abuse sometimes, and, unlike with women, no one seems to care that much...
@Persistence: Yeah, you pretty much have to be in one of the few areas that bothers and isn't harassed for it. :(
A lot of what we can do is education and awareness-building...as in, when our friends laugh at woman-on-man violence (which is common in comedy), point out that if it would be creepy if a man hit a woman in the same situation, then it's creepy when the woman hits the man too.
But be prepared to be ignored a lot. :(
Due to the amount of mexicans in SoCal, create an account using bogus information, that only the OP would know. You'll have to pay a security deposit due to no SSN, but it's so worth it to have personal piece of mind.
I'm not clear on something, and it sounds stupid when I ask, but I'll ask anyway. The OP wants his or her SoCalGas account password protected through the phone, right? Obviously if you register your account online and set up bill management or whatnot, it's password protected, but the OP is talking about making sure someone can't call and pretend to be the OP and find out information, right?