If a SIN is a purely passive system, this would work; but there's no reason to believe it's a passive system rather than an active one. There's a concept known as asymmetric key encryption. In its current form, it's based on prime numbers of extremely large size, though that's secure primarily because of the computation infeasibility of factoring extremely large numbers; that particular method is fairly unusable in the Shadowrun world because of the massively improved processing power, but the theory stays valid regardless of implementation.

Anyway. The simplest forms of key-based encryption are "symmetric key"; you have a key K and a message M; encrypting a message M with key K gives you ciphertext C; and then decrypting C with K gives you M again. Decrypting C with any other key (Q, X, or T) gives you absolute garbage. Asymmetric key encryption is different in that you have two keys, K and L; if you encrypt M with K and then decrypt with K, you get garbage. However, if you encrypt with K and decrypt with L, or encrypt with L and decrypt with K, you get the message back.

How is this important? It lets you authenticate a person, and prove that you are who you say you are: and here's an example of how.

When you have a SIN, the two keys (Kg and Kc) are stored separately. One (Kg) is stored in a central location (government DB), and the other (Kc) is stored on the commlink who is broadcasting the SIN. Both are linked to a public ID - your SIN. The SIN is then linked to all your records. So, a policeman comes up to you on the street. You're broadcasting the SIN 5184-VJ24-XQQ1. He sends a query off to the central database, and says "Please give me the encrypted text for 'Are you really John Smith?' using the Kg associated with SIN SIN 5184-VJ24-XQQ1." The central DB sends back "jnf;aasjl;newjl;cjnvj;;fldn;eldj", and encrypted message. The policeman sends that random crap to the person whose commlink he's querying. If, and only if, the Commlink has the correct Kc associated with that SIN, then it will decrypt the garbage and send back the correct message. If it is in fact a bad fake SIN, or just broadcasting a false SIN, he won't have the right key; and the message the policeman gets back will be wrong.

Now, remember, with the amazing speed of SR4 tech toys, this all happens in the blink of an eye; and, more importantly, the identifying message that the policeman sends will be unique - including a timestamp, a date, the last score from the Denver Dragons, and the current ambient temperature in Bora Bora. However, since communications are nigh-instant, he just pushes the virtual button that says "Authenticate this guy's SIN" in his AR view, and it instantly comes back with a green light or red light.

So; now, back to your message. You were watching some guy last week, and you copied his SIN, and copied the response he broadcast to an authentication check. So, you re-broadcast that authentication; unfortunately, the timestamp, date, ambient temperature (they're having a cold snap!), and last score (one of their main players is out sick this week) have all changed drastically, and the query comes back as garbage. Red light goes off, drones start converging, backup is called in, and they ask you politely why you're pretending to be someone you're not.

So no, there's no reason to assume that you can hijack a SIN simply by listening to what's broadcast.

To go further... In theory, there's no reason why you can't have an unhackable SIN. It's pretty easy to create a small electronic device where it has two sets of contacts; one used as an input, one used as an output. Internally, it runs a quick decryption scheme against the inputs, and the outputs then provide an answer. There's no other way to access the device; the key used for that decryption simply isn't available electronically, no matter how much you hack or how hard you try. So you insert that into the decryption/authentication algorithm; and suddenly, you can't steal the SIN by the simple measure of hacking into the commlink and "borrowing" the secure SIN configuration file that the authentication scheme uses. If the authentication scheme is properly designed, you'd actually have to physically steal the chip to get it to work right.

And these are just the schemes in common use today; there's no reason to think they couldn't be massively more intricate 60 years in the future.

This would also explain why creating fake SINs is talked up as such an involved and difficult process; they would have to inject accurate but undiscovered responses into the government's systems.