Identity "theft" is corporate responsibility laundering. It is not "theft" it is "lack of safeguards on PII" plus "lack of meaningful, protected PII" combined with "A complete lack of proper vetting of loan / credit applicants"

Someone put the right 10 digits into a webform? What could we do! They stole your identity!

No, you just didn't want to force someone to walk into a bank to apply in person because that would cost more and reduce your new applicant rate.