It turns out, a billing address and the last four digits of a credit card number are the only two pieces of information anyone needs to get into your iCloud account. Once supplied, Apple will issue a temporary password, and that password grants access to iCloud.
— Excerpt from Mat Honan’s “How Apple and Amazon security flaws led to my epic hacking”.