Comment by tyingq

You can encrypt it, but then it's useless for anything other than keeping state on the server side, and only across form posts. In which case a session id would be simpler. It seems to be a holdover ASP.NET feature from when browser support was weak for things like cookies.

In this case, they just really shouldn't have sent the SSN at all, as only the last 4 were ever displayed on the page.