It seems more fundamental to me. Credit firm customers aren't the victims. The generalized GOP party line is that this kind of thing is better left to private

It seems more fundamental to me. Credit firm customers aren't the victims. The generalized GOP party line is that this kind of thing is better left to private enterprise and the federal government shouldn't spend time and money coming up with some sort of identification strategy. So what business has the motivation to spend that kind of effort? Google or Facebook? It's kind of a perfect storm of sorts, there isn't any pressure to fix it, anywhere. The public has even lost interest in it, for the most part.