Far too many places use the last 4 of a SSN for customer support representative (CSR) validation. It's supposedly one of those "pieces of information" only you would know, but, sadly, is more often better known that we'd like to think. It can then be used as part of a social engineering attack to gain access to, or control of, an account. Here's an account of how something similar was used to gain control of a reporter's Apple account and wipe all his devices.
As Honan explained, Amazon allowed users to add a credit card number to an account simply by calling Amazon and providing a name, e-mail address, and billing address. After hackers used this method of adding a credit card number to Honan's account, they hung up—and then called Amazon back to claim they'd lost access to the account. At this point, they provided the fake credit card number, convincing Amazon to let them add a new e-mail address to the account. The next step was going to the Amazon website and requesting that a password reset e-mail be sent to that e-mail address. From there, the hackers could view the last four digits of Honan's credit cards on Amazon's website.
With those four digits (and Honan's username and billing address), hackers convinced Apple to send a temporary password that let them take over his iCloud account and wreak all sorts of havoc. "The very four digits that Amazon considers unimportant enough to display in the clear on the Web are precisely the same ones that Apple considers secure enough to perform identity verification," Honan wrote.
I can't tell you how often I've had a CSR just take the last 4 of my social as proof that it's me.