Any bank or financial company always tells everyone they never ask you to verify your password or any other information that is personal in nature, it's always a good idea if you get an email like that to double check on the phone with them if your unsure.
Even if Paypal wants your SSN for IRS purposes I would still get a live person on the other end of the phone and do it that way, I'd never send that kind of information over the net you never know if it's the right site or not.