Company that I’ve requested my personal info from wants my account password to confirm that the account is mine

I wanted to use my rights given to me through CCPA. I emailed a company to request that they send me my info that they’ve collected. The email I used is the same as the login email that I use on their site. They want to confirm that I actually am the account holder and I completely appreciate that but... they want my password! That’s something we’re never supposed to do. Is this common? Isn’t this kinda shady? What should …

account password personal privacy