Bad security

After receiving an SMS this morning about a login on my Vodacom account, I phoned the number in the SMS to query the login. After waiting 3 minutes to get to an agent due to voice prompts (after these I immediately was put through to an agent so was not due to congestion). During this time I was able to startup my computer, login to the website and change my password before getting through to an agent that only was able to advise I change my password.

I requested to talk to technical support as the agent is not able to tell me where the login was from. Technical support verified that they are unable to inform me where my account was accessed from. The account where my SA ID number (in full) is displayed in plain text on the profile page. When questioning the security policy and lack of 2-factor authentication, I was told they updated their security policy 3 months ago.

I have encountered video game websites with better security than this and find it unacceptable that an FSP that presents such sensitive personal identification information (and so much of it, SIM ***** anyone?) cannot even tell me where this information is being accessed from.