i still get hit from time to time because of online purchases. But every time the bank has contacted me immediately ... no, I did not buy $400 of Indian curry in London (I was in Brewster MA when that one happened)
As for CC the most one can be held accountable for is $50. The 2 times the CC companies tried holding me responsible I informed them I wouldn't pay anything ... at all
... charges were removed.
It is mainly finance and retail that compiles and sells people's personal data more than anyone. I remember reading an article years ago about a data collection agency in San Diego, they used to sell data packets for $20/ea or so. Turns out they had been selling peoples info to the Mafia in NYC
all in the name of business I guess