The real problem is most payments & identity are pull vs push and the username is the password. If they were push, then there wouldn't be customer payment info

The real problem is most payments & identity are pull vs push and the username is the password. If they were push, then there wouldn't be customer payment information to steal in the first place. All that would be taken would be personal shipping addresses, and those are mostly public as it is already. Same with social security numbers and identity in general. To solve the root cause in this case although was decided to not be good by the infrastructural organizations. Eating the fraud is cheaper than putting up barriers to payments. If fraud liability was moved %100 to banks, payment providers and governments, we would see the problem fixed pretty quickly.