> They contacted my insurance and the insurance sent them my SSN

If all you're doing is making them get the information from someone else, what exactly are you accomplishing? Adding a bit of friction to a process?

I mean, fine, if that's the aim, but it sounds like this was intended as more of a “they don't need this information at all, and if you don't give it to them, then they won't have it” technique, and (apparently) that doesn't work.