This happened to me in CO. I received two debit cards in the mail earlier this Summer to a previous address, one for the one CO uses to distribute unemployment benefits, one for an Internet-only bank based out of CA. I think the fraudster got my info from CO's voter registration record, which is public by default. The address on there hasn't been updated.

I had to fight the CA bank over the course of several weeks before they would close my account, and only after I had filed a complaint with the Consumer Financial Protection Bureau. Pro tip: do this for any financial disputes; financial firms will be very responsive to your issues.

I also called the bank CO uses to distribute unemployment benefits and they were much more amenable to my request to close the account.

For CO's part, the only link they provided on the CO Dept of Labor's site to report fraud (a Google form) had language to basically say that I am reporting myself as the fraudster and I would be subject to perjury in filing the report. For obvious reasons, I didn't fill it out. (It took them months to change the form.) I then called their main phone number and the only way I could talk to anyone was to schedule a callback 2-3 months later.

Ended up freezing all of my credit bureau accounts.

BTW, I don't place this fault entirely on CO. It was a hectic and uncertain time and they were trying to distribute funds into people's hands as quickly as possible. I don't expect them to be able to change such a complicated process overnight, or even months. It's a clear example of fraudsters being well ahead of regulators.