Organizations that hold personal data should be made liable for fraudulent transactions, say BT security experts.