I get people upset about us asking for the passwords on the phones, too. However, we don't do it for verification. We basically do it for email problems (to check if there's a large mail on the server, to find out if their account is email only, or to find out if there multiple failures) or dial in problems (you're getting a user/pass error when trying to connect? Let me try what you're typing and see if it works).
Now, Customer Service should automatically have access to your account information, including passwords. Why? Because they're the ones who have to set up your account, and make changes to your account. Tech Support, it depends on the company. In my company, the regular technicians have to see a lead tech to look up the password (I'm special, I have my own access, but that's because I was actually putting in accounts for a provider 2 years ago, and they never took it away. It's useful for my hotline/support mail days, though). But customers can change passwords, and it won't be reflected in our system, as it only shows the original password. Also, customers will be typing in the wrong password, so by asking customers for the password that they're typing in, we can verify that it is, in fact, the correct password. We've had customers become irate when we ask for their passwords, but if we didn't do that, we couldn't properly do our jobs. Besides, they called us, so they should know we are who we say we are. We can verify that the customer is who they say they are by key information in their account, including a verification code.
While I have no compulsions about asking for passwords on the phone, I will not ask for a password over email. If a person requests that we send them their password over email, I will give them the phone number for their local customer service office. The only password I do send out is the initial one for our quarantine service, and that password has no bearing on any other account functions. Wire-tapping doesn't happen often, and it takes a bit of knowledge to do it. But any idiot can accidentally open a virus that may send out that person's password in an email.
