I misplaced my Paypal debit card (somewhere in the house) and logged into paypal to cancel it and get a new one. Yes, I had to give my ssn#. This was logged into paypal. No email, no spoof. Uncle Sam just wants his pound of flesh. BTW, I no longer and haven't in years, used my paypal as a business account but do like to be able to use the debit card, saves a few ¢ on some purchases, every little bit helps.
So yes, Paypal asking for your SSN CAN be legit.