MR CSR asks me for my marriott.com password
 

I called MR customer service yesterday to get a points discrepancy fixed. In any case, the CSR claimed that she didn't see the discrepancy on her system. I explained that I was looking at my account history online and was able to view the error.

At that point she asked me for my username and password so that she could see for herself. I declined to provide her my password, and I was kind of shocked that they would ask me for that. I told her that she would have to find a way to view it on her system - since Marriott obviously has access to my account info. At that point she got a supervisor, who was indeed able to access the needed information.

Has anyone else been asked for their password? I'm sure she meant know harm, but in this day and age where we have so much concern about online security, fraud, etc., I would have thought that asking a customer for an online password would be verboten. Any thoughts?

A CSR should NEVER ask for a password. Reformed hacker Kevin Mitnick wrote a great book entitled The Art of Deception. In it he discusses how asking a question like that can lead to identity theft, especially if you use the same password elsewhere.

Never been asked for a password and don't expect that I ever will. You are correct in that there should not be any reason for a CSR to ask for a password. While you may very well be correct in that no hidden agenda was meant when you were asked for the password, there is really no way for you to know personally. And by giving out the password, you give up one of the most basic and foundational tenets of security, traceability.

I would have immediately asked for the CSRs name and asked to speak with the supervisor. It may be a lack of training, but it might just as well been something else.

some introspective thoughts
 

Judging by how you describe things, I suspect that the rep was simply trying to help.

Certainly Marriott forbids this sort of thing for obvious reasons. To me, in this instance, her response sounds like an earnest attempt to help as you push your own querey forward. That she immediately gets a supervisor would seem to support this interpretation. She none-the-less does err in asking for your PW.

The real question is whether this is a "hanging offense"?.

One could take the morally outraged approach and raise hell about it. But will she receive a reprimand or will she be terminated? All of that is out of your hands once you make the phone call and the true context of a conversation that only you and she truely understand will be in the hands of others. OTOH, does she even realize that she made a potentially serious mistake?

It's always difficult to judge/interpret these sort of things retrospectively. I'm not going to suggest anything here. Hopefully Marriott reads these threads, and something useful might arise from it.

Barry