Although i'm completely cynical when it comes to this kind of stuff but i can see only a friendly request "so far".. i'll tell you what.. this might appear to be a bit technical but it's nessesary for every average user..
This is the method.. to verify the source of this message and compare with what they claim inside it :
1- Go to the message u received in yahoo
2- Look for a small text Under the message .. on the right side of prev-next-back that says "Full Header"
3- Click on it..
4- a long description will appear in the top of the message.. look for
Message-ID : some text..
Received : from [192.168.0.1] by web.yahoo.bla bla bla
Date : some date..
5- copy the number (IP ADDRESS) between the brackets 192.168.0.1 in this case..
6- go to http://www.geobytes.com/ipLocator.htm
7- paste the number in the field Ip Address to locate and press submit.
In less than two seconds you will know from where di that message generate exactly..
And remember as others told you.. NEVER share personal information like SSN or any form of financial info with someone you don't personally know..
Good Luck!
-----------------------UPDATE--------------------
For MSN Mail Services (Hotmail/Msn/Live) you can do the following:
1. Windows Live Hotmail must be in "Full Version" mode, not "Classic" mode.
2. Right click on the link to the message in the column left of the preview pane.
3. A drop-down menu will appear and at the bottom will be "View Source".
4. Click on "View Message Source" and the Full Header information will open in a new window.
5- Look for the 5th Line saying Received.. that's the IP address of the server or machine that generated the message and sent it to your mailbox at msn.
6- Sometimes you might find another Received Field under the first one.. that means the user had used a mail client like OutlookExpress or so and not using a webmail.. this one is more specific of course since it reveals the INTERNAL ip address of the sender.
P.S Graham: i used the 192.168.0.1 as a demonstration only.. obviously i will not use a real ip address in a public post.. "Security Basics" .. you never know who's browsing ;)