This past Sunday I do something I almost never do, I actually visited FordCredit.com to try to find out exactly where I am with my loan and when I will be free and clear of having to make another a car payment. Within seconds of bringing it up I remembered EXACTLY why I never go to their site and quite truthfully why I'll never use Ford Credit again to finance a car.
A bit of history. So in some ways I should be a bit more sophisticated with how I remember my credentials for websites. And yes, I know there are services out there made for people like myself that are afflicted with this totally curable disease, but let's face it, my authentication problems only really exist with sites that I don't frequent that often. Knowing this, I tend to rely pretty heavily on the password recovery features that sites like these offer.
With FordCredit.com however (I will attempt to get that site reference in there as much as possible) they have a unique twist with their password recovery option. In order to use it you must have your account number. This is an odd thing since:
- I don't receive paper bills that would have the account number printed on it (unbelievably their site actually makes this suggestion).
- Their second recommended approach for recovering your account number was to call their customer support number, enter my SSN, and retrieve my account number by listening to my account summary. Which of course if I did that why would I even need to use their website?
I would love to know who within their engineering team had the 'fabulous' idea that my account number was such a vital piece of information to securely retrieve my credentials? It's not as if there are not other ways to go about verifying who I am. In fact, pretty much any site today does this by allowing users to answer security questions or in some cases (like my bank) placing a voice call to my house or text a code to my cell phone that allows me to reset my password.