The ssn was just my personal example of how rampant information theft is. I don’t have plans to sue anyone for it at this point. What I’m saying is that people think they’re talking to their banks employees when in fact they are not and then giving them all the information they ask for under the guise of customer service.So you owe money to the bank on a delinquent debt and these calls are by third party debt collectors hired by the bank to collect that debt? And is the debt owed a consumer (i.e. nonbusiness) debt? If that's the case and they are not truly bank employees then they must follow the rules in the federal Fair Debt Collection Practices Act (FDCPA). For a summary of your rights under this act, see the Consumer Financial Protection Bureau page on it. In addition, the collector has the same responsibility under state tort law as any business to take reasonable steps to secure and protect the personal information you provide to it.
If this is a third party collection agency collecting a consumer debt then it is at least as regulated as a collection call center run by the bank itself, and in most states it is actually more regulated then a bank call center would be. That's because most states don't regulate either one. There are a few states that apply the same rules the FDCPA imposes on third party collectors to the debt collection activity of the original creditor, but most states don't. So in most states, if it was the bank itself collecting, you'd not have the protection of the rules in the FDCPA.
How do you know the person got your name and SSN from the debt collector and not someplace else? If you can prove that the person got it from the debt collector then you may be able to sue the debt collector for negligence. And if you can show the bank was negligent in selecting the collector, i.e. that the bank knew or should have known that the collector had poor data security policies, you could include the bank in that lawsuit too. But if you have no proof then all you are doing is speculating that the collector is responsible.
Now, I would not give out any personal information to anyone, including a debt collector (perhaps most especially a debt collector) who cold calls me and asks for it. I would verify first that the caller is legitimate, preferably with some other source that I could trust. And I advise clients to do the same thing: verify that the person contacting you is actually who they say they are before giving up any sensitive personal information.