A spoofed email address and an easily faked document is all it takes for major tech companies to hand over your most personal information.