> Which is the fault of the person treating it as a password Fault isn't the important question. Often the damage is done to the SSN owner, with zero consequen

> Which is the fault of the person treating it as a password Fault isn't the important question. Often the damage is done to the SSN owner, with zero consequences to the person/organization who misuse and/or mishandle the data.