yea, in the US, we use the SSN or the last 4 digits, as a security question, which is why it can lead to identity theft
the goal would be to stop using SSN(4) as a secret