The alleged use case for masking is people might be looking over your shoulder. In reality that's of course very rare; the few times someone is looking over your shoulder you'll almost certainly know (presenting/sharing something on your PC with someone) and you'll probably either not input any passwords, or you'll ask them to look away (or turn off your projector). Outside of certain contexts where over the shoulder reading really IS a risk (like demo/presentation PCs which really shouldn't be accessing private data anyway), the real factor is trust.
People expect password fields to be masked so there's an implicit breach of trust when users see it unmasked.
Related is Why should we ask the password twice during registration? and my answer on the topic of password masking/unmasking. In an old usability test a group of friends and I discovered 20% of our users explicitly mentioned the password being unmasked; and this was just a college project to try out a usability test, not a real product.
However, while masking passwords is a convention (and built-in functionality to browsers and operating systems the world over), masking credit card numbers and SSNs is not generally expected. So you don't get that shock of "OMG my password isn't masked?!" If anything it is a convention to not mask these fields on other sites, so your users might have the doubly unpleasant shock of input being both different and much more difficult.
Finally, checking the wrong credit card number can get you/people/the card in trouble. If your masked design results in a bunch of failed credit card # checks against the wrong address (because people mistyped it and couldn't see it) people could potentially get fraud alerts. And with Social Security Numbers you probably can't validate them at all, so if the user can't validate them and you save the wrong one you've screwed up pretty massively.
The only proper use-case I can imagine for masking CC/SSN would be in a system with complete validation, so if the proper SSN for that user isn't entered, you get an error, and where the system is in a very public place where the over-the-shoulder problem is real. An example of this is the standard ATM workflow, however ATMs just want your PIN, which is much much easier to put in with masking and, unlike SSN, can always be validated.