Identity theft is an amazing PR term, not-so-subtly shifting blame onto the individual whose identity was fraudulently used.

* The PII wasn't stolen from me, it was negligently exposed by services I contract with (and pay!) and others that I have no formal relationship with (like Equifax).

* It wasn't defrauding me, it was defrauding services I contract with (and others) who failed to verify my identity.

And yet somehow I'm obligated to do the cleanup myself.

Yup. The quickest way to stop these sorts of things from happening is to make the banks responsible for accepting/using stolen information(ie facilitating identify theft). For some odd reason, its the person's responsibility now that the bank used fraudulent information.

The concept of "identity theft" (i.e. the hacker stole your identity vs. the hacker used false credentials to steal from the bank) is probably the single greatest feat of social engineering of our times.

Point. Identity hacking would be more accurate.

In that the attacker is creatively operating the system, rather than really possessing magic knowledge.

Today, you are not you, you are your data, a persona. And you are somehow responsible for it or anything that casts a similar shadow.