quick update...
received 2 letters from SSA on this, before and after our reply #1 where we suspected phishing entirely.

SSA letter #2 : indicated the query was prompted by recent reform of overcounting income from certain groups that were exempt from SS deductions.

SS letter #3 : indicated information was required regarding a named pension payor, although SSA maintained false assertions regarding dates and payments. no evidence was provide from our reply#1, such as 1099-R that must exist has anyone received such.
this letter ended with a threat of assigning some random amount ($9999) as pension paid were we to ignore.

rather than wasting any more time. we replied with documentation on named payor with actual pension start date and amount.
we also granted permission that they may contact the payor in regards to this matter , by u.s. mail only, so there is a chance some record of potential malfeasance\incompetence survives. and also no data dump into SSA\OIG happens.

there has been no response from any of the groups where we reported letter #1 as phishing fraud, despite that we already admitted the origination of the letter from SSA seems genuine.