> The attacker had merely called in to PayPal’s customer support, pretended to be me and was able to reset my password by providing nothing more than the last f

> The attacker had merely called in to PayPal’s customer support, pretended to be me and was able to reset my password by providing nothing more than the last four digits of my Social Security number and the last four numbers of an old credit card account. Requiring the full number of a current credit card seems much more sane to me too. Or maybe you're referring to a driver's license?