TL;DR: Social engineering attacks work. I was able to reset my Ameritrade account password by giving the support person the name of one of the stocks in my portfolio (along with some other basic identifying info).
They work against the service company you mean. This is not a normal vector. The company is supposed to be smart enough to not divulge their customer's accounts through social engineering.
You should ask Kevin Mitnick about that :)
http://en.wikipedia.org/wiki/Automatic_number_identification
In an unrelated incident, I was talking to T-Mobile when the phone got cut off. They called me back (which was amazing customer service) until the first thing he said was he needed to authenticate I was me. So I was supposed to give him the last four digits of my social. I tried to reason with him why it was a bad idea but ended up thanking him and telling him that I'd call in at a later time.
Source: I work in VoIP, handle hundreds of thousands of 1-800 numbers on my network, as well as a lot of calls to toll-free numbers.