I don't see the term stealing identity as something that implies I have done something wrong to allow it. If you have something stolen from you it doesn't mean you have done something wrong to allow that. If someone broke into a bank vault and stole your money it wouldn't be considered your fault.

The challenge in cyber security is that the person potentially stealing your identity lives on the other side of the world and that's why the focus is on the end user to be as secure as they can. But if you have something stolen from you, you are still the victim.

Yeah, it doesn’t imply you did something wrong. However, the “attack” is against the institution they get a loan from, not you. You didn’t give them money under false pretenses. You had absolutely nothing to do with it.