No I wasn't under the impression it was a rule with legal penalties attached, but I mostly hear this as "can you confirm the last 4 numbers to verify your ident

No I wasn't under the impression it was a rule with legal penalties attached, but I mostly hear this as "can you confirm the last 4 numbers to verify your identity". It's a pretty clear cut case of using it for authentication. And rule or not - it's effectively a 4-digit PIN that probably half the services I have to call into re-use, so it's just plain stupid.