There is a line of feasibility—if John Smith has my face, my fingerprints and all of the passwords, John Smith is not me yet an ordinary institution can reasonably claim that beyond their sophistication to detect—but we are far from approaching that line when we speak of modern identity theft. Today it often sounds more like “someone stole from us by fooling our staff so we will just go ahead and reimburse ourselves from your account, thanks!”
Also, I am not a lawyer (are you?), but I don’t think there is a legal concept of “identity” that is somehow different from the metaphysical I of a person. I could be wrong though.
(I hate to make this argument because in a non-ideal world with malicious actors it appears to advocate for zero-trust dystopia with pervasive biometric checks, which is not my intention.)