Instead, a web hook a.k.a. call-back URL would be better
Sadky that is a lot more complicated than a security issue. If the computer "requiring" the callback is behind NAT that wont work.
Now, NAT may be:
* Your home router protecting your home network

* The WLAN you are logged in - doing the same
* The stupid UMTS provider doing the same.
etc.etc.etc.
So, it ends up having a otentially not knowledgeable user trying to work around his firewall, OR even trying to do so WITHOUT having access to said firewall. It is quite common for networks one logs in to allow outgoing traffic but be NAT'ing for various reasons - I have seen this in Hotels, companies etc. I do the same in my own, actually.
All that means that this is simply not a working solution outside a well controlled environment.
What one CAN do (but that is not in the standard) is have a permanent HTTP callback channel - basically the application asks for a URL and the sever keeps it open, never closing it, writing out events as they appear. This is used by various chat systems. It is sadly not really covered in any standard.
I can't see the benefit of using these web-service (be it SOAP, REST or other) technologies for the problem domain of account management, order placement etc. OTHER than the ability to leverage all of the tools and libraries that have sprung-up around these fashionable areas over the last few years
Now realize that those tools are a LOT more than Trigger, Facebook and you get a point.
Some usefull tools on my desk that support web services are:
* SQL Server Integration Services. Like for downloading transaction history and acccount data to a database daily automatically.
* Visual Studio / .NET - point it to a standards compliant web service, wrappers are auto generated.
* Various reporting frameworks that work well with XML and could load it from a URL

Makes quite some stuff. I really miss a REST / XML based account statement mechanism at Mirus / RCG.... to automatically pull account statements into a database.