Some of these are becoming quite convincing. Not long ago, I got a very convincing email from someone pretending to be Citibank, and it was convincing enough (grammatically correct and carrying all the graphic elements of the Citi website) that my first impulse was to call up Citibank and ask them if they were crazy, sending requests for information like that via email. I can see how someone could be taken in by a well-done scam like this.

The key is, no matter what a site or vendor tells you, no legitimate vendor will ask you over email for your social security number, credit card numbers, or passwords. Only supply this information on the web if you initiated contact with the website and you are certain you are in fact dealing with who you think you are. If you're unsure, call or email the company directly and make sure.