Or maybe it isn't? The bank obviously claims that you are on the hook for something you didn't do, based on a transaction that used insufficient authentication

Or maybe it isn't? The bank obviously claims that you are on the hook for something you didn't do, based on a transaction that used insufficient authentication to determine that it was (supposedly) you. Whether it's a credit card number or an SSN that the bank is using as a password even though it is not a secret doesn't really make that much of a difference, does it?