The biggest single problem is that businesses accept data as identity, but then are allowed place the consequences of that (improperly confirmed) identity on in

The biggest single problem is that businesses accept data as identity, but then are allowed place the consequences of that (improperly confirmed) identity on individuals. Currently they get the best of both worlds (all of the benefits of trusting random strangers with almost none of the consequences). This gives them no incentive to properly verify their customers are who they say that they are. The "rework" to the system would be minimal if the impact of identity theft was a business' responsibility to handle. Businesses would reshape their processes based on the risk that they'd be willing to accept. Instead, we have a system that's broken, where individuals are punished for companies' (deliberate) incompetence.