The Pensions Ombudsman has upheld a complaint against Embark after it failed to prevent identity fraud which cost a client £20,000.