It's a heuristics quirk. It starts with "unknown unknowns" - the things you aren't even aware that you should be concerned about. Then add in a relationship where someone is trying to fix something for you. If you've never been trained to refuse information from someone who's seemingly trying to help you, it would never occur to you.

When you go to the doctor and they prescribe you pills, most people don't question it and just take them. And that leads to a lot of people taking antibiotics that they don't need. Or when you move and need to sign up for internet, phone service, power, water, electricity, gas, etc.... almost all of them will ask for your social security number. Even I don't know when it's mandatory and when it's optional, so usually I ask them first, but sometimes I don't.

The last time I witnessed this was some malware that infected an ex-roommate's laptop. The malware pretended to be an anti-virus and said she had a virus on her computer that it would fix. But first she needed to pay for the software - by putting in her credit card info & social security number. She complied because the files on her laptop were very sensitive and she didn't want lose them, and she had no idea that there was no reason to ask for a social to pay for this software.

We could probably do more as a community to educate people on keeping sensitive information secure. Part of it involves media outreach, as most people seem to get their news from the TV or Facebook.