When arranging to do work remotely, how can you verify that the client is legitimate and that you can trust them with your personal tax ID (social security number in the US)?

In the US employers are required to get your tax ID if they want to deduct the amount they pay you from their income, so it's reasonable for them to request it.

All of the remote work I've done so far has been for clients that were vouched for by someone that I trusted. In some of those cases, the client wouldn't make any payments until I sent them my Tax ID.

This question is specifically about dealing with a situation where you don't know anything about the client:  
You reply to a listing they posted on a job site.  
They contact you on your site or through a site where you've posted your resume.  
They are not a large company with an easy to verify existence and history.  
They are a small company, which may have been founded 10 years or 10 months ago.  

So what do you do when a new client wants your tax ID before they will make any payments?

Is it reasonable to ask the client for references? If so, what kind of references and how should they be verified?

Some possible reference types I've thought of:  
People who've worked for them.  
Some of their clients/customers.  
The bank where they maintain their business account.

I realize that there's a certain amount of trust required on the part of both parties when doing remote work, but how do you go about minimizing the risks of giving out your tax ID?