I can tell you, from personal experience, that the vast majority of sites still don't bother to send a Confirmation Email before allowing you to create an account.

I have a gmail address that I secured back in 2004 which is fairly short in length. Multiple people other than myself have used that email to sign up for all sorts of things which never bothered to confirm that the user actually owned the account before happily signing them up. AWS accounts, hotel sites, innumerable soccer and fantasy-football related sites, etc.

Every time I would try to reach out to the service to tell them that I had never signed up for an account as the email holder, they would give me the same non-answer: "Well if you own the email account, just reset your password and then delete it!" Nope. Not doing that. It was their negligence that allowed the account to be created under my email in the first place. I am not going to acknowledge ownership of the account to cover their fuck-up.

If they don't do any verification, and I'm not sure how they would in countries like the US, then any fraud case or attempt to claw in money from random people should be thrown out of court by any reasonable judge.

Requiring only public information and a SSN that has probably leaked hundreds of times and can be accessed by any number of random people in public and private administration just shouldn't count as even an attempt to verify identity.

I've signed up for a few bank accounts purely online. And if you give them your SSN and enough other information, they're able to pull all your credit reports, in real time, and then do verification based on them, that tends to be quite effective.

If Cash App had run some sort of bank-level verification, I doubt a garden-variety scammer could've "stolen her identity" like this. But, since Cash App is not a bank... they don't need all those pesky safeguards, do they?

Well, now you get to the absolute travesty that is:

Identity theft is a failing of other people that is your problem to solve.

This very nearly burned me when buying my home - having been an AT&T customer in the PNW for nearly two decades, "I" apparently decided to hit up a Walmart on the outskirts of El Paso, sign up for a Verizon service, run up two months of international calls and bail out.

Despite a police report, my utility statements, AT&T bills, etc. (all of which were, to be blunt, none of VZWs business), VZW stood by it initially, "On review of your documentation, we remain satisfied that this debt belongs to you based on the documents used to open your account".

I asked to see them, since they were, in VZW's own words, "mine". "We can't, for customer privacy reasons." Oh, so "mine when the bill needs paid, may not be mine for privacy purposes".

We constantly face the consequences of businesses failing to secure the information which they (and in some cases legislation) requires us to give them. And when it (inevitably) is lost, then you're offered "free credit monitoring"...

The CRAs compete for breach business, because it's absolutely a profitable enterprise for them:

If you've ever signed up for one of these "free credit monitoring for a year" following a breach?

When you do, you typically do so by signing up for the highest tier (sometimes $30 or even $50 a month) product with a redemption code for one year free. You have to enter a credit card to do so, and to no-one's surprise, if you don't cancel in time, it automatically converts to a paid subscription "for your convenience".

There are many consumer protection farces in the US, but right up there has to be the notion that "identity theft" is the consumer's responsibility/obligation to prevent or resolve, not the entity that actually had the data stolen. You're considered liable until you prove innocence, even though you did nothing wrong.