I just finished "Ghost in the Wires" it was an amazing book. Reading it confirmed that the weakest link in any security system is the people who use it. The fact remains that 100% security will never be the attainable, simply because of the inherent "trust" we as humans have for each other. Maybe the companies need to ask for the second to last 4 digits of a credit card. most companies display the last 4, but if the customer service would ask for the second to last 4, this would not be visible. The back end systems could be set to only display this information to the customer service individuals. Still making it secure for the user. It would be similar to a private key that only the user and company would know.