Credit Card numbers are useless to even the DHS, if they are acquired under false pretenses.
A long time ago I read a book called "Hacksaw", about a long-time felon that had, at that time, held the record for the most prison/custody escapes.
The first thing he did when he escaped was to head to the nearest cemetery. He then began looking for headstones that had a birth date near to that of his own (but NOT the exact same), AND had a death date less then a year more recent then the birth date on the stone. In short, he looked for the gravestones of children that died shortly after birth. He wrote these names down, then did a little library research to determine if the child had died in same locale (newspaper obituaries). If they did, he discarded the name and researched the next.
What he was trying to do was find a child that had died in area DIFFERENT then where it had been born. He had figured out that unless BOTH the birth certificate and death certificate were on file in the same recording office, he could then apply for a new birth certificate in that child's name with almost zero chance of the recording office realizing the name was that of a dead child. Since the child was dead, and at such a young age, the chances the child had been issued a SS# were next to nil.
At this point he could apply for a birth certificate in that child's name, a VALID SS#, and from that point he had a new identity that was not stolen. It was now HIS, and it worked like a charm every single time he used this method. I see no reason to think that he could not start creating a decent credit profile with a clean record.
I have no idea how this would work these days (he was doing it back in the 70's), what with all the new-fangled techy stuff, but it goes to show that where there is a will, there is a way.
Security Theatre, indeed.