>however then the burden shifts to proving that person C was not really person A First: No. The burden is on B to prove that C is A, the default should be that

>however then the burden shifts to proving that person C was not really person A First: No. The burden is on B to prove that C is A, the default should be that if they cannot quite definitively identify the counter party then tough cookies. And they need to do this while covering all expenses and time value with interest in the event they're mistaken. Second: if only! Most identity theft is not even remotely subtle. It's people walking in with mediocre quality forged documents or minimal info literally hundreds or thousands of miles from any location C has ever visited in their lives. Or someone randomly claiming to be C via some simple 10 digit government number and an email address C has never used. Etc etc. It's not exactly mission impossible hacking-a-passport-and-wearing-full-3D-facial-prosthetics-and-voice-changer stuff we're talking about here. Standard "ID theft" is just from a financial party with all the incentives to push through acceptance as frictionlessly as possible and then simply hound whomever they can try to pin it on and feed them into "debt collection" systems until most people cave. What the law needs to recognize is that everything about this should be literally criminal. The original criminal is the one who committed the original fraud. But everyone who goes along with it from then on out, every single 3rd party directly trying to steal money or time or whatever from the innocent victim, is an accessory to that fraud. All of them are involved, though as always they can seek (after paying their penalty) to shift expense/liability back up the chain if they can prove it. It's their fault for insufficiently verifying the original counter party, and then they've compounded it by seeking to defraud someone unrelated.