In a just world, companies such as this lender would not only lose the money they loaned, but would be liable for the vast amounts of time and grief they caused a completely unrelated individual.
Only then might we get a financial system which is robust against ID theft. While the costs are externalized to countless individuals, nothing will change.
I wonder at the likelihood of success if this person were to sue the company in his local small claims court for a claim at N hours multiplied by $80 per hour to fix the problem. At the minimum it would require them to hire local counsel to show up and answer a statement of claim.
There really should be an investigatory process when credit is fraudulently taken out in someone else's name.
How did the company get duped into making the loan? If the answer is something like "we treated an SSN as identification", that company should lose the right to be a credit issuer.
Only then might we get a financial system which is robust against ID theft. While the costs are externalized to countless individuals, nothing will change.