Most likely use the ITIN.  Often the case when someone enters the US illegally and starts working, they present a fake SSN card to the employer. Don't know why there's no automatic rejections, if the employer is *cough, cough*, concerned.  But now client having obtained the ITIN, use that as the official taxpayer identification.

Aside from that, in cases where it is a valid SSN and you can't see the full number, do you have the chance to ask the client?