I did, but I also saw this: They could also do things like send paper mail to the last long-term address, to confirm it. Why don't they do that for credit card

I did, but I also saw this: They could also do things like send paper mail to the last long-term address, to confirm it. Why don't they do that for credit card requests? At a guess, it's because these stronger schemes are too inconvenient, and will drive away consumers who are trying to apply for credit. If that guess is correct, it suggests that the real solution is regulatory: make credit providers liable for the full damages, including ongoing inconvenience, suffered by victims of identity theft. SSNs are not the problem; authentication commensurate with the risk to all parties, including especially individuals, is. That’s a loooooot of guesses for my taste.