No, please don’t try. I’m not extending an open invitation to anyone, but my 401k company is putting us at risk. We recently changed 401k vendors and yesterday in the mail I received my welcome letter and access PIN.

What you see here is at the bottom of the letter, an invitation to write down my social security number along with my PIN, then clip it out and save it. Anyone at work reading this? Well good, here is my advice:

• DON”T write down your SSN
• DO shred the letter and
• DO change your PIN

• The website application doesn’t force me to change the PIN. Come on now. Andy, the ITGuy, count me in for your campaign to make vendors force us all to change the default passwords.
• The letter actually invites or perhaps encourages you to write down your SSN, PIN then clip and save it. Even some 15 years ago when I got my first ATM card, the bank strongly cautioned against writing down my PIN anywhere.

Note: even though the image above says “nCircle Network Security”, we didn’t send out the letters. They were sent by the 401k company. So don’t think for a moment this is some common practice to nCircle. Whats more, I bet every person from many organizations using this large, nationwide company have all been put at risk.