You use this question if someone expresses an opinion you can't accept. "Says who?" is not a question. It is an... aggressive answer. Quite impolite. You can't believe what your partner said. So you ask who had this idea. You want to find out where it came from. It is like a threat.

And it is often heard with the expression: "Oh yeah? Says who?" A similar expression which is even more impolite challenges an action: "I"m going to make you give up your seat!" "Oh yeah? You and what army?"

"Says me!" is an aggressive response to the aggressive question, "Says who?". Basically the responder what to make absolutely clear that they feel this way and it is not only the opinion of others that they are passing along.

To add to what Domasla said... This response is intended to disarm the person who made the statement. It questions the person's authority and shows that you disagree. Example: Person A is sewing a blue stuffed animal toy as a baby gift. The gift is for a girl. Person B says "why are you making a blue toy for a girl? Girls only like pink!" Person A "says who?" By asking the rhetorical question "says who" this shows that Person A disagrees with the statement "girls only like pink" or "blue is inappropriate for a girl". And it also calls into question where Person B's authority comes from in making this statement.

And there is a very informal spelling- wrong, but you see it in comic books as though the different spelling makes it slang: Sez who??? I'm not saying you should write it that way, but you can understand it.