The last 4 digits of an SSN are the sensitive ones. The others are mostly guessable if you know where and when somebody was born, which is why the 4 digits often get used as a password. Like any password, you shouldn't be storing it - at most you should be storing a salted hash (e.g. combining the customer's other information and some long secret that belongs to your database) that you calculate each time and compare, and even that's pretty weak for a 4-digit password.