That's another good example of language engineering.

If a crook fools a bank into giving them money, the bank is the victim of the theft. It should be one of the banks primary responsibilities to authenticate the parties to whom they give out money. But if the crook is good enough, it's fair to say the bank is the victim.

But instead they say "you are a victim of identity theft" in order to make you the victim.