<font face="times" size="+0">I emailed MS in the past before regarding whether you need the transferee's Member# and they clearly said that no, you don't. You only need the full name, and mailing address of the transferee.
This year MS has been better about verifying your identity when you call them (usually last 4 digits of SSN, which I have issues with as really it should be something else other than SSN, but I guess it's still better than nothing). But not 100% of the CMs will <i>always</i> verify your identity each time you call.
And reservations can be made via email or online that don't require any identity verification at all.
I guess some unscrupulous person could pretend to be you and use your Member# to make a reservation in their name, and use the reservation before you ever find out about it. That's the real security issue.</font>