It seems like a major identity-theft liability to distribute your EIN or SSN to everybody who's bought $600 worth of goods or services. If you're doing consulting work, you should have incorporated and therefore have an EIN (which I suspect is more secure than SSN). But if not, you're going to be giving your SSN out to lots of people.

Based on the average net-profit of identity theft, would it be worthwhile for scammers to "invest" $600 to buy a product from somebody who they suspect hasn't incorporated, just to get their SSN?