I'm feeling paranoid now and wondering if the best defense is to proactively open accounts with Cash App, Venmo, whatever other stupid peer-to-peer wallet apps exist, just to lock down my identity and be in control of it. I'm not sure if locked credit and monitoring would work here because these services probably don't do credit checks or show up on reports anyway.

I felt the same way, and made a CashApp account, but I don't think it matters. It didnt say anything about the fraud account having her email address. It just had her name and they inputted her social. I don't think there's anything you can do but pray.