I happened to purchase a multi currency card as I was preparing to travel abroad. I enquired a few non tech friends of mine about a bunch of providers/lenders and I got a consistent suggestion of how company XXX is safe and user friendly. I took a leap of faith and went with them, since I didn't have any time left to do my own research.

Met the vendor, loaded some money and all is well. At least so far.

I went to their website to create an account for checking my balance and to do a bunch of stuff online.

Nothing unusual so far.

I fill up the new user register page. At the end I get a message which says "SUCCESS" and asks me to check my email.

VOILA!

I have an email with my user id, password and security questions in CLEAR TEXT sitting in my inbox.

Good job XXX.