I think this differs widely from country to country. Here in Sweden our SSN equivalent (personnummer) is public information accessible to anyone by calling calling the register office and today even via various third party online services.
Companies publish their SSN on their websites.
The key for recipient in intra-country payments is account number plus SSN.
Identity theft is rare. I've always found strange reading about credit card scams in USA where people go through your garbage and get a credit card in your name. Here you'll have to show up in person and identify yourself.