The real solution is not in prevention but in recovery. If the recovery option is easy and fast, then prevention doesn't really matter - detection and recovery will be key.
1) Transactions have to reconcile somewhere--monitor at that point for unexpected activity.
2) Use insurance policies to pay back losses due to theft.
Payment info is among the data I worry about the least; I check my card statements every month, and flag any unknown activity. Under my card and bank agreements, I'm not liable for losses if I catch them within the defined window (30-60 days depending on card), even if I did something stupid like set a weak password or lose my own wallet.