[ataggart]

Perhaps a first step would be to stop referring to it as "identity theft". That phrase places you as the victim, thus implicitly any injury is yours to bear. The proper victims of the fraudsters are the businesses falling for it, thus those firms should be the ones on the losing end (instead of you). Perhaps if they had to bear the costs of fraud, those firms would care more about shoddy identity practices.

[PeterisP]

Coincidentally, outside the US of A, where the fraud liability indeed lies with the defrauded business, "identity theft" is a much smaller problem, and isn't called as such.

[dredmorbius]

Pushing the liability to the bank rather than merchant would also be a huge step forward.

Just so long as there's not a bailout back-door on that.