Feel free to nudge me elsewhere if this has been discussed.

Called to get my GPUs (SWUs) extended (tried for January, ended up with December 31, and am now trying to play roulette to use them).

While on the phone, the agent says "You haven't selected a PIN. You need to pick one. Shall I do that now?"

She also made me tell her my (now changed) password before working on my issue.

I said, well, no, I don't want a 4 digit pin usable on the web site, I prefer a password for security. "Well, you have to select a PIN for when you call us to verify identity."

Will it only work when I call, or online too? "It will only be for calling, not the web site. For the web site, your password will work."

She was pretty insistent, so I let her because it was holding up my real issue.

Of course, now I can log in using my PIN or my password.

What's the point of both a PIN and a password? And why would the less secure method be forced? I get that pmCO had PINs and pmUA had passwords (my password ported properly to new website). Is there some other way to manage identify verification with them beyond sharing my password or using a 4 digit PIN?