If you are a victim of identity theft, if they manage to get money out of your bank, investment, or retirement accounts, you are probably never getting that money back.
You can go to IdentityTheft.gov for a good checklist of things to do if you've been a victim, but they don't suggest anything to help you get the bank or investment broker to take mercy on you and make you whole. (Indeed, from their point of view, if they started paying off on identity theft claims, they would multiply exponentially as people would not take precautions against identity theft.)
If you are not a very comfortable Internet user -- such as if you don't know how to set up and use and maintain unique strong passwords for each different site you subscribe to or each business you patronize on the Internet, you might want to consider NOT doing any business on the Internet and asking for trusted friends to buy things for you and you give them cash or checks for those things.
If you aren't able to clearly recognize spam and phishing attacks promptly, you may need to adopt a strict "no click" policy of never clicking on anything in an email, just like you would never invite people into your home before looking through the door to see who is out there.
(And if you're a super-comfortable Internet user, don't get cocky! People who are experts fall for scams online all the time. Remember, in the old days, you could pretty much only get ripped off by local criminals. Now, every criminal in the world is just one click away from you.)