If money is stolen from my bank account by an impersonator, the bank is liable as, in falling for the impersonation, the bank's systems proved insecure. It is the bank's money that is stolen: not my identity.