Thanks, sorry for the duplicate discussion, I'll follow the other threads. I get the idea of the PIN for quick, over the phone ID check. And I get the idea of the password. And I guess I trust the COdbaUA employees fine. But I just don't like the PIN (4 digits only) being able to access my web site account. My password I ensure is very strong and definitely more than 4 numeric. This is an issue for me as another flyertalker reported unauthorized access to his web account, so passwords do matter.