I've seen it argued that "identity theft" is the way businesses with poor fraud detection make that your problem.

I.e. there's no "identity theft", there's fraud, and the company that was defrauded tries to weasel out like it's not their laxity at fault.