A CSR should NEVER ask for a password. Reformed hacker Kevin Mitnick wrote a great book entitled The Art of Deception. In it he discusses how asking a question like that can lead to identity theft, especially if you use the same password elsewhere.