Avoiding data theft

I'm pretty new to web security so I'm hoping someone can clarify
something for me.

Basically, I'm wondering how to avoid the following scenario:
1. Windows application calls web service with user-specific data and a
unique ID identifying the user's account on the server.
2. Malicious user eavesdrops on that call and copies the user-specific
data.
3. Malicious user replaces the user's ID with his own unique ID and
sends that along with the intercepted user data and has thereby stolen
the user's info.

I've fully encrypted all data being passed back and forth using WSE and
I'm sure this is accounted for somehow, I'd just like to understand
how. Is this where the certificate comes into play?

Thanks in advance.

.

Loading