With the General Data Protection Regulation, any leak of private data caused by a major cybersecurity gap in a company will lead to severe financial sanctions such as a fine based on 4% of the company turnover.
This law will indeed give the risk a “cost” :).
The risk we need is to introduce is to make banks (not customers) responsible when banks allow themselves to be tricked w.r.t. personal identity. This would motivate them to come up with identity verification schemes reflecting ~anything at all that the security community has figured out in 50+ years.
The problem has been for faaar to long that doing tech right takes much longer than the business side of the company is willing to wait for.
Once CEOs know that they can go to prison if their customers' data is stolen, I assure you that they will suddenly become very interested in making sure their underlings follow best practices.
Right now the "risk" has no cost - if you expose people's data there's not that much consequence besides bad PR. We should assign some dollar value to each person's identify leaked. That way, businesses can properly asses risk and reward when they start these types of projects
Overtime, I think businesses would rather avoid the liability of storing people's info in the first place