It already works like that. "Identity theft" is entirely framed as a problem for the citizen, affecting them and that it's their responsibility to resolve or face the consequences (credit score, collections, etc.) when all the citizen did "wrong" was choose an institution who cared more about profit than security. For the institution, all their obligation often seems to be is to "partner"[1] with a credit monitoring service.

[1] A credit monitoring service that will give the institution that "free 12 months" at a vastly reduced bulk rate because it knows that in order to sign up for free credit monitoring you actually sign up, with a card, for their top tier product (which might otherwise be $50+ a month) on what is effectively a 12 month trial after which they switch you over to a paid subscription (hell, there may even be commissions paid to the institution for anyone who neglects to cancel quickly enough). The incentives are so perverse.