Following the usual US business standard, it's probably just cheaper to deal with it as it stands instead of fixing it.

For example, create a law that forces a business that transacts with an identity thief to pay to the victim three times (or whatever) the amount spent in their name as compensation. Then you might see some changes being discussed.