The bottom line is the fact that there's literally nothing anyone can do with the last 4 of your SS number, so I've never had an issue of giving this information out. It would be rather stupid if they were to report to the IRS before then. Online casinos never have reported squat to the IRS, nor will they ever, until the day comes that online gambling is legalized and regulated in the USA. Guests continue to report issues across MGM.
It's rather easy to get around the combined transactions part, unless you go to the same cage and end up dealing with the same cashier all of the time. The outage has now rolled into its fourth day, with MGM saying on Thursday that the company was working to resolve our cybersecurity issue. B&M casinos don't even ask for this, until the time that you try to make a transaction at the cage for $10,000 or more in one shot or $10,000 in combined transactions. One of the main and most well-known Title 31 requirements is that casinos and card clubs must record and report the identity of individuals who conduct more. Anyone that gave that information out to an online casino is just plain stupid, IMO. Of course they're not asking for your whole SS number. I seem to remember certain MGS casinos asking for this, but I could be mistaken. I remember some casinos asking for the last 4 digits of your SS number dating back pre-UIGEA.
I think they are simply asking for the last 4 of your social for identification purposes, should it come down to that.