Public shaming might be a way to go. Ironically served http only;)

Tell your company you're getting the loan from to get their act together. If the ship goes down and your information gets leaked, feel free to call the police for the stolen information and hire a lawyer for the method of which it was stolen.. (The site was insecure, so ultimately, it's the company's fault.)

Use a unique password for this site. Also, I am not sure if they are using HTTPS but considering the other security loopholes they have, I won't be surprised if SSL is missing as well. In that case make sure to always access the site from a relatively trusted network where no sniffers are installed. Granted that people who own the network or tap into the ISPs routers can still get all the info in plaintext over HTTP but this is the best you can do right now.

They could be storing the password encrypted instead of in plaintext; which is marginally less bad. It avoids a trivial plaintext leak from just a DB dump or SQL injection. It's still not good practice because if the server's compromised the attacker will probably be able to extract the decryption key with a bit of extra work.

I could be wildly wrong about this, but aren't institutions that handle government-issued info like a SSN required to have certain security measure in place? Or did I just make that up?

@thanby That probably depends on the jurisdiction. If it was in Denmark I would report that company right away.

@thanby I was thinking the same as well, I will look into that. I'm going to wait to see if/what they respond and take it from there if necessary, but I assume some BBB-like action could be warranted. I'm in the US.

you need to keep full SSN properly secure, but last 4 digits doesn't count for the protection

If someone gets into your account then hopefully they will help pay for some of the loan? :)

Do they require you to have an online account? Could you just use your bank's bill pay feature instead of having them pull money out?

@DeanMacGregor it appears you are not required to use the online account, in fact the privacy statement it says if you don't agree to our privacy statement don't use our websites. So I suppose that's what I'll do. I'm just going to hassle them about their security on principle at this point.

@DasBeasto now the trick will be to trust them that they actually delete your online account when you ask them to.

@thanby you're probably thinking of FISMA compliance.

@Ivan Hm you might be right, in which case it seems it wouldn't actually apply here.

Assuming the connection is over https it's far better that your password is on screen than sent to your email. Email is not secure. Of course this does not affect the other glaring problems with their password recovery scheme.