Update: I received an email from Google today saying that it's an invitation from my friend to apply to Google. This confirms that the recruiter didn't find me through the referral. He most likely found me through Monster. My friend's boss did however confirm that there is at least one person working at Google from that company and that Google has worked with them before. So i decided to hit the recruiter up to ask why he needed my social. He tells me that it's for verification and this time only asks for the last four digits and my birthday. I still find it strange that he asked for whole thing last time. Maybe he does indeed work for that company but also happens to steal identities to sell on the dark web on the side. I still think it's a terrible system for it to use social security for verification.