Couldn't they just claim that "someone stole your identity" because that seems to works for banks and similar institutions?