100%. The very concept of "identity theft" feels like corporate newspeak to shift the onus of remediation from the party that actually got defrauded (the company) to someone uninvolved in the transaction.