If they want the last four of my SSN, then they need to prove to me that they already have my SSN. Same goes with the other data.
I wish sites like this would do a double-sided challenge-and-response type of authentication instead of this overbearing "give us everything and we'll let you know if we agree that you are who you say you are - or not. And we'll keep any information you've given us during the process."
For example, if my SSN was 123-45-6789, then they could say something like "give us the 4th digit of your SSN, to which I reply "4", along with a request that THEY give the 8th digit (which I would choose out of the remaining digits). If either side messes up, then authentication has failed. And chances of a site correctly guessing more than 2 digits drops off fast enough to keep most crooks at bay.
Or, if they need the SSN for identification, then they could use some of the other information such as birthdate and name to prove that they already have your data, instead of only for authentication of you.
Or, pass a token from the "annualcreditreport.com" website or whatever it is that verifies that I have authenticated for my SSN, and force these guys to prove that they know my name.
Congress is not helping us with any of this, of course. And they could. They just choose not to.