I once had my session completely swapped with another user's session when using GEICO's online management in 2008. This sounds like a one-time error, but since I had the other user's contact information in front of me, I gave him a call and sure enough he was logged in as me, and me as him. We both called geico the next day explaining the situation and their senior IT folk got back to me within 24 hours saying they had fixed the bug. I always wondered since then how often this happens on large sites.