Innocent until proven guilty isn't it? If companies want to easily proof that someone did the transaction in question, all they have to do is verify the identity properly.