I don't think you'll necessarily run afoul of this law by simply asking for an SSN as a means of ID verification. My reading of this modification to the MI Consumer Protection Act is that it was designed to prevent businesses from requiring an SSN prior to delivering services, unless you're a bank or other exempted business.
Here's the legislative analysis that covers this & similar bills that became PA 462 of 2004.
My broader question is this - if your caller doesn't know his account number but does provide an SSN, do you have confidence that you're releasing information to the actual customer? Or could this be an identity thief? Maybe you also ask for amount of last deposit / payment, or ask for some pre-established PIN or code word - just a thought...