If they're willing to brag about their passwords on the internet, I'd be willing to bet that family and friends have the same information. Assuming that wasn't

If they're willing to brag about their passwords on the internet, I'd be willing to bet that family and friends have the same information. Assuming that wasn't true, a customer service rep for the phone company could call the customer's bank and try to impersonate the customer, assuming it's used often (like the poster stated).