I would argue that credit bureaus leaking all your information to criminals and then charging you money to protect you from those criminals is also criminal fraud writ large.
We've established that sufficiently advanced fraud can overcome the ability of organizations to vet the info that’s given to them. If the credit bureaus are actually organizations dedicated to fraud, then the fact that many other organization fall for it doesn’t tell us too much about their accuracy.
If Osama bin Laden's ghost appears to you and says "There will not be a terrorist attack in New York tomorrow.", and then there is, and this repeats a few times, the fact that his statement is, facially, a lie, and the fact that he can't even exist doesn't matter. You have an input that correlates with a certain output. The intent of the person who provided you the input, or even how nonsensical you think the input is, doesn't change its statistical usefulness.
They didn't. Pension plans and individual investors are not sophisticated financial organizations. They rely on those that are to do their job in a non-fraudulent manner. They didn't.