sub ss_last_4 {
    my $n = shift;

    $n =~ tr/0-9//cd; # We can only work with numeric digits.

    # There are some basic constraints we can assure are met.
    die "$n cannot be a social security number.\n"
        if     9 != length($n)
            || $n =~ m/(^0{3})|(^\d{3}0{2})|(0{4}$)/  # A grouping of 
+zeros represents a fictitious SS number.
            || substr($n,0,3) == 666                  # Prefixes that 
+== 666, or are >= 900 and <= 999 are reserved.
            || substr($n,0,3) >= 900;

    # Still alive, return the last four.
    return substr($n,-4,4);
}
[download]

Just today a website rejected my phone number because I entered it without hyphens. Amazing how something that is really only a formatting convention gets baked into validation. Ok, for socials hyphens are supposed to be a requirement, but how many times have you visited websites where the hyphen handling is wonky? IMO it's easier to filter them out on input, and re-apply them on output.

Don't be tempted to use SSN::Validate (which could easily return the last four for you); in 2011 the US government made changes to how the first three digits are allocated, and the changes broke assumptions made in that module.