Not before doing anything with it, just before processing it for specific business use cases like targeting.

Running a forumn is fine, and I don't care if someone inputs a fake SSN on a forumn post.

I DO care if someone inputs a fake SSN on a financial form I provided, and it is actually my responsibility to prevent that. That's what KYC is and more.