This is why I skip the password step altogether. We do have a list of customer email addresses already linked to the information they can view - if they enter

This is why I skip the password step altogether. We do have a list of customer email addresses already linked to the information they can view - if they enter their email address and it's in the list they get a link that will log them in for 12 hours and can see their associated data. If their email address isn't registered they're told to speak with their sales rep. This of course trusts that email accounts are the highest level of security a user has, which it should be because so much relies on it these days.