A mac address is physically burned into the hardware, so yes, technically you could alter it in a way besides spoofing it. If you were clever enough to physically change how they burned it. And software exists to spoof a mac address. Then once again we’re back to plausable deniablity. My account was hacked, which is pretty much the same as saying, “I left my computer on and went to lunch.” 
The thing about identity theft is it’s SO EASY TO GET without being very sneaky.
Let me tell you, do you fill out a job application. Do you put your social secuity number and references on it. If you do, I could get a credit card in your name. It happened to me. One time the moron in H/R filled it out and I GOT THE JOB. I was working at the hotel as an asst controller and the moron in H/R in corporate used my info.
He was making like $10 bucks an hour and taking info from applicants and using it to get more info to open charge accounts. He normally did this to people didn’t hire. I don’t know why he slipped up and used mine. Most likely he wouldn’t have got caught if I didn’t work there.
As long as you have low paid people in positons which have access to your data, you are in danger. I worked for a temp agency and they put me in a bail bond office. There I learned the power of $50.00
It’s a joke. I mean you ask them they say “I can’t give out that information to anyone who doesn’t work here.” Then you give them money. “What’s up boss?” is the reply 
When I worked at the bond agency, when we bonded you out, we take photos. If we needed to find you, I’d go online and open a Facebook or MySpace page with your photo and pretend to be you. It almost always worked. You see people came TO ME with information.
This is why social engineering as it’s called is far more dangeorus than lags in security. People want to help.
One thing that is especially dangerous is using the same password. Most people use the same login and password for everything. If I have access to the SD password base, I can go to various sites and randomly try. This is why banks have recently started doing more and more challenge questions. My bank account now requires me to answer THREE different challange questions, and they are randomly generated from a total of ten challange questions I had to answer when I signed up.
But this isn’t even enough if someone knows you enough to answer your challenge questins. This is why you should make up answers and stick to them.
For instance, if the challange quesiton is “Who was your childhood best friend.” I wouldn’t use his name but rather the name of his father. Or his mother or his sister.
That way if someone who knew me tried to get in, they’d get the wrong answer.