SSN is a primary key, not a shared secret.

The entire problem is that people started using SSN as a shared secret, but it was classic password reuse. Use the same secret every fucking where.

No. If you want to establish trust, use a random secret for each new trust relationship.

If you want to establish identity ask the identity providers what kind of anti-forgery guarantees they provide. Oh, nothing, you say!? Then don't use that provider.

Banks are trying to use easy to forge things to make sure they won't lose money. Sounds like stupidity. So they limit their stupidity (hence you can't just register for a credit card online, otherwise bored Russian teenagers would have already bankrupted them).

What if, when you replaced your SSN, banks could use a system that would return "invalid SSN" on any new credit application. The existing accounts would be suspended unless you called them and updated your SSN. It would be about as much as a hassle as updating all of one's autopays when a credit card number gets stolen.

I don't want to call up all of my business address book because one of them fucked up and leaked something.

They shouldn't even ask for it.

Currently fraud is held back by law enforcement. Which is triggered by fraud detection. Which is triggered when the wrong person gets a call from a collections agency.

And this chain of events is too long, but since there's no global (national) system to check if someone is a professional scam artist or a regular bloke, that's what banks are left with.

One irony is that for my US visa I had to have an interview, supply a photograph, have my fingerprints taken and submit to an eyeball scan. Making the US visa inside my UK passport more reliable an identifier than the passport itself.