Two of the comments make the excellent point that much, maybe most, identity theft consists in a friend or relative stealing personal identifying information and that such "retail" theft should not be punished nearly as heavily as the kind of professional identity theft that my post focused on. The way to deal with this problem, however, as in the case of most crimes that embrace acts of widely varying gravity, is to set a broad statutory sentencing range--say from fine and probation at the bottom to 25 years in prison at the top--and within the range to promulgate sentencing guidelines based on the magnitude of the particular defendant's conduct and other relevant factors, such as his criminal history.
A recurrent issue in criminal law enforcement is how much responsibility for crime prevention to place on potential victims. In principle, it is always cheaper to deter crime by threat of punishment than to require victims to incur expenses to protect themselves from crime, because maintaining the credibility of the threat is likely to be much cheaper than victim self-protection because the latter requires every potential victim to incur costs to avoid being a victim. (It's the difference between penning danagerous animals in zoos and leaving it to every homeowner to fence out dangerous animals.)
But this is in general rather than in every case. The more costly it is for the state to apprehend and prosecute and punish criminals, the more likely it is for victim self-protection (or some combination of public enforcement and victim self-protection) to be optimal. In this vein, some comments express concern that banks and other vendors are not doing enough to prevent identity theft of their customers because they hope to shift the loss to the customers. I doubt that this is a serious problem, but if it is it may argue for requiring protective measures by the banks and vendors.
One comment puzzles over the fact that bank robbery should be a sucker's crime--that is, that though the expected gain is slight relative to expected punishment costs, the crime is still common. It is a puzzle. But my impression is that bank robberies nowadays are committed mainly by stupid or mentally unstable people, who are tempted by what seems the simplicity of giving a bank teller a threatening note. When as perhaps in that instance deterrence fails, the alternative is incapacitation--long sentences to prevent the bank robber from repeating his crime if it is thought unlikely that he will be deterred by the threat of a longer prison sentence the next time (recidivists get longer sentences, having shown by their first crime that they are less deterrable than the average person).
I greatly enjoyed the comment that pointed out that the first and most consequential identity theft was that of the serpent in the Garden of Eden, by Satan. This is not in Genesis, where Satan is not mentioned, but in later versions of the Fall of Man, notably Milton's Paradise Lost, where Satan takes over the serpent while the latter is sleeping, and convinces Eve that she should eat the forbidden fruit because he, the serpent, did and it did him no harm--indeed, it enabled him to learn to talk!