I read an article about a fellow who is having a problem with his PayPal account. While trying (unsuccessfully) to get it resolved, he found himself on the PayPal web site reading through their privacy policy and came across a rather disturbing policy clause. It seems PayPal has decided that, under certain circumstances you may be asked for your credit card, debit card or bank account number, but they will prove to you that the request would be legitimate by showing you the last two numbers, thereby proving they they know the entire number already.
But how hard would it be to phish you with that? I mean, there are only 100 possible combinations. Any semi-serious malefactor could simply send out 100,000 messages to users requesting verification of such numbers, saying basically that "we know the last two numbers are 25". Based on this policy, 1000 users could potentially presume this to be legitimate and give up their numbers. I don't think I could appreciate PayPal, or any entity that's dealing with my money, having such a weak spot like this.
I hope the Powers-that-be at PayPal come across this guy's story and does something about it before someone is burned.