Given the level of expertise on this Board this info might be too basic, but you can apply to the Social Security Administration to have limited access to their online database to confirm a SSN. Once authorized, you can input name, DOB and SSN and immediately find out if the SSN is valid for that participant or not. It will not give you a correct SSN, will just confirm or reject one you already have. You can also batch process large numbers of SSNs, which is helpful for ACA reporting for covered dependents. It is called Social Security Business Services Online.
In this case it will give you "official" proof that the SSN you have for this employee has not been legally assigned to them.
Tangentially-related stories--we had an employee who, when preparing for his retirement, wanted to know why his "prior service" was not included in his pension. We had no record of prior service despite excellent records going back many decades and asked him for details. He claimed we had employed him many years ago under a fake name and SSN when he was in the country illegally. We did have a record for someone with that name who had been fired for job abandonment, and we told him if he could provide records (leases, utility bills, pay stubs, or anything else) that could plausibly link him to that name and address/SSN, we would give him prior service credit. That was the end of that. We also had a participant whose 401(k) enrollment kicked out of the recordkeeper's system since another client's employee had the same SSN and the SSA confirmed that our employee was not the legitimate holder. Of all the SSNs available, how unlucky for him that he had to pick one that was already associated with an account at that particular mutual fund vendor.
And before you ask, it turns out that the company that did our background checks only checked to see that the SSN had been officially issued and had not been reported as deceased. They did not take the additional step of making sure it belonged to the person who was using it. We have since fixed that.