This is correct, the SSN is an identifier. (Yes, I know the card is marked not to use as
identification, but that's different. The problem is that a secure transaction (on-line or off), requires an identifier
and an authenticator. An identifier is like a username - it identifies who the party is. An authenticator is like a password - it attempts to confirm the entity supplying the identifier is the real one.
The problem is that the SSN is used as both identifier and authenticator, which is an inherent flaw. The SSN is a de-facto identifier. Any attempt to use it as a shared secret authenticator is doomed.