thin-client remote node lying through omission
Peers who don't use the whole blockchain are relying on at least one of their peers to send them transaction data when a transaction satisfies the bloom filter that the SPV (simplified payment verification) node has set. As such, SPV nodes have to be careful about which peers they connect to, and that they have a variety of peers. I believe some implementations of SPV nodes only connect to a set of defined, or are at least configurable to only connect to a strict set of peers. 

Read how the bitcoinj (SPV node implementation) creator describes its security here:


  Because bitcoinj apps do not accept incoming connections, the peers you talk to are always randomly selected at startup (based on DNS seeds today). So it can be difficult for an attacker to control your connectivity like that. For this reason, the number of peers that have announced a transaction is exposed in the TransactionConfidence object and you can listen on that to learn when new peers have announced a transaction. Once most of your peers have announced, you can be fairly sure that the transaction is propagating its way across the network and is very likely to be valid.