you are falsifying what customer you are. the guy literally said he put in different customer IDs into the URL after he discovered what part of the string was a customer ID. It would equate to a guy walking to your door, saying he's from the electric company, then reading the medical documents on your desk after you let him in.