There have indeed been issues of identity theft here in Sweden where the thieves ordered a new login to the 2fa app and then managed to get hold of it from postal offices with bad verification processes.

So now the practice is to fetch the credentials from the nearest bank office or something like that.

It should be simple:

When applying for new accounts, or logging in from new devices, you should be receiving an email and/or sms on the endpoints of your choice. And then able to stop those things from happening.