This would be bad; we've already had a few cases on HN where someone noticed that they could increment the customer number in a URL or similar, resulting in police action.