Doesn't the birthday paradox/pigeonhole principle apply here? If we assume that there are 1,000,000,000 unique values, then the square root of a billion (31,622) is all you need for a 50% chance of collision.
That's only if SSNs are randomly assigned. They aren't.
The issue is people are giving AT&T incorrect SSNs.