Privacy Rights Clearinghouse
- What types of identity theft can monitoring services protect against?
- What types of identity theft are not covered by monitoring services?
- Is there a low-cost alternative to monitoring services?
- Is there a free alternative to paying for monitoring services?
- What features should I look for if I decide to purchase a monitoring service?
- Do I need to purchase identity theft insurance?
- Are there steps I can take to reduce my risk of identity theft?
Hardly a day goes by without hearing about someone becoming a victim of identity theft or learning about another data breach. The exposure of Social Security numbers (SSNs) and other personal information can increase consumers’ susceptibility to identity theft.
For the 15th consecutive year,
identity theft has topped the Federal Trade Commission’s (FTC) national ranking
of consumer complaints. Identity theft
represented 13% of all complaints in 2014 according to the FTC's 2014 Consumer Sentinel
Network Data Book .
Identity theft has held the FTC’s No. 1
spot for 15 years. According to Javelin Strategy & Research’s
March 2015 Identity Fraud Study , fraudsters stole $16
billion from 12.7 million U.S. consumers in 2014. Privacy Rights Clearinghouse’s “Chronology of Data Breaches” documents over 816 million records that have been compromised since January 2005. www.privacyrights.org/ar/ChronDataBreaches.htm. 
Faced with these alarming statistics, many consumers have turned to identity theft or credit monitoring services for protection. Identity theft monitoring services may sound like a good way to protect your good credit and your good name. However, some of these services are overpriced and are not worth the money that they cost.
How effective are these services in protecting consumers from identity theft? Do their costs justify the protection provided? Are there effective alternatives available to consumers at lower cost? This fact sheet examines these issues and more.
To start out, you need to be aware that these services vary tremendously. We use the term “identity theft monitoring services” in its broadest sense. Many of these services only provide credit report monitoring. Some provide other monitoring services in addition to checking your credit report. For example, they may monitor information in commercial and public databases, and in online chat rooms. Some may also monitor “underground” websites that identity thieves use to trade in stolen information.
Most identity theft monitoring services include a menu of additional services ranging from credit scores, insurance, identity theft resolution services, and access to your credit report. We’ll discuss these in the section “What features should I look for…” below. But first we will talk about the general limitations of these services. We will also explore free and low-cost methods for protecting yourself from identity theft.
Credit monitoring services protect primarily against new account fraud. This form of fraud occurs when a criminal uses your personal information to open credit card, mobile phone, or other financial accounts using your name, Social Security number, and other personal information. New account fraud can be difficult to detect because the criminal generally has billing statements sent to an address other than your real address.
It may take some time before you become aware of new account fraud. You might learn that you are a victim when you apply for a new credit account and are rejected because an imposter has opened accounts in your name, giving you a low credit score. Or you might be tipped off when you are contacted by a debt collector for a past-due account that is not yours.
Credit monitoring does not actually stop the opening of new accounts. But it usually enables you to learn about the fraudulent accounts sooner than it takes for debt collection companies to track you down.
Some monitoring services may provide you with a false sense of security because of holes in coverage. For example, a service may only check with one credit bureau rather than all three, or may fail to report activity in inactive accounts. Unless the service specifically states that it will be monitoring all three credit bureaus (Equifax, Experian, and TransUnion), you should assume that only one bureau is being monitored.
Generally, credit monitoring services cannot protect against the five kinds of fraud which we will describe below. Some more comprehensive services may be able to provide limited protection against these other types of fraud. Generally, services that claim to provide more comprehensive protection monitor online chat rooms, blogs, and news sources to look for evidence of criminal activity. However, there is no assurance that a particular fraudulent activity will become the subject of an online discussion. The ability of such enhanced services to protect you from fraud is as yet unproven. Clearly there is a tremendous amount of fraudulent activity that does not get discussed online.
In our opinion, most identity theft monitoring services are unable to provide anything close to complete protection for the following kinds of unlawful activity:
Existing account fraud. Existing account fraud occurs when an imposter uses your current accounts (ones that you already know about) to commit fraud. For example, an imposter could use your credit card account number to make a purchase from an online vendor, or your bank account number to make a withdrawal. This is also referred to as “account takeover” fraud. You generally learn of such fraud by carefully reviewing your monthly account statements. Some financial institutions offer services that can send you an email or text message if a transaction posts to your account.
Debit or check card fraud. Debit or check card fraud occurs when an imposter uses your debit card or check card (or a “cloned” card or the information from your card) to remove money from your bank account. The imposter does not need to know your PIN because he or she will be able to use the card for an “off-line transaction.” For more information, read www.privacyrights.org/fs/fs32-paperplastic.htm .
Social Security number and tax refund fraud. This form of fraud occurs when an imposter uses your SSN to obtain employment, for tax reporting purposes, or for other illegal transactions. For example, an undocumented worker might use your Social Security number to obtain employment. Or an imposter might use your SSN to avoid paying taxes on their income. www.privacyrights.org/fs/fs10-ssn.htm. 
A rapidly growing problem is identity theft-related tax refund fraud using stolen SSNs. You can read more about tax refund fraud at http://www.gao.gov/products/GAO-13-132T  .
Criminal identity theft. Criminal identity theft occurs when an imposter gives another person's name and personal information (or counterfeit documents) to a law enforcement officer during an arrest. Frequently, the imposter fraudulently obtained a driver's license in the victim's name and provides that identification document to law enforcement. Or the imposter, without showing any photo identification, uses the name of a friend or relative.
In many cases, the imposter is cited for a traffic violation or for a misdemeanor violation and is immediately released from the arrest. If the imposter then does not appear in court at the appointed date, a warrant of arrest will be issued under the victim's name. If at a later date the victim is stopped for, say, a traffic violation, he or she may be arrested because of the outstanding bench warrant.
In other cases the imposter is arrested, booked, and convicted of a felony. The victim’s information is then recorded in criminal records files compiled by local law enforcement, the state Department of Justice, and/or the FBI. For further information, see the PRC’s guide on criminal identity theft. www.privacyrights.org/fs/fs17g-CrimIdTheft.htm 
Medical identity theft. Identity theft involving one’s health information occurs when an imposter uses an individual’s name and/or other information (often insurance information) to obtain or make false claims for medical goods or services. Medical identity theft may result in erroneous entries being entered into an existing medical record, or the creation of fictitious medical records in the victim’s name.
This potentially can have fatal consequences for the victim. For example, in an emergency room setting, the victim may be unconscious at the time of treatment. If the victim’s medical record reflects the imposter’s blood type, allergies, medications, or other medical conditions, health care providers may make dangerous errors. Read more about medical identity theft at the World Privacy Forum's Medical Identity Theft Page .
The best low-cost alternative to credit monitoring services is a security freeze. A security freeze locks your credit files at the three credit reporting agencies (Equifax, Experian, and TransUnion) until you unlock your file with a password or PIN. The freeze stops new accounts from being established by imposters because potential creditors are not able to check your credit report or credit score, the standard procedure when financial accounts are opened. Any potential creditors’ requests for access to your credit files will be denied.
However, a security freeze cannot stop misuse of your existing bank or credit accounts. You still must check the monthly statements on your current accounts for any erroneous charges or debits.
Generally, you will pay no more than $30 for a lifetime of security freeze protection. In some circumstances (identity theft victims and senior citizens in some states), this protection may be free.
With a security freeze, your credit reports cannot be seen by prospective creditors, insurance companies, landlords, utilities, or for employment screening. However, you may lift the freeze when necessary to allow a company to check your credit report. This is easily done by means of a password. It is important to realize that a security freeze does not prevent existing creditors from seeing your credit report.
While a security freeze may be the best available deterrent to new account fraud, it may not be the best solution for everyone. It can be cumbersome for individuals who frequently apply for credit, are contemplating a new mortgage, or who plan to change jobs. On the other hand, a security freeze is particularly well-suited for seniors who are no longer in the market for new credit. And a freeze provides protection for individuals affected by data breaches involving Social Security numbers, as well as victims of identity theft or mail theft. For a more complete discussion of the pros and cons of security freezes, see www.consumersunion.org/pdf/SecurityFreeze-Consider.pdf  and http://www.consumerreports.org/cro/news/2014/02/should-you-put-a-security-freeze-on-the-credit-file/index.htm . Brian Krebs' post How I Learned to Stop Worrying and Embrace the Security Freeze  is a primer on what you can do to avoid becoming a victim of identity theft.
Fees, supporting documentation, and procedures for placing a security freeze vary from state to state and among the three credit reporting agencies. The web sites of each of the credit reporting agencies provide state-specific instructions for placing a security freeze.
- To obtain contact information for the three credit bureaus, see www.consumer-action.org/english/articles/freeze_your_credit_file .
- For California-specific information, see http://oag.ca.gov/privacy 
Yes. In fact, there may be several, depending on your situation.
Fraud alerts. You are entitled to place a free fraud alert on your credit reports even if you have not yet become a victim of identity theft. You can do this by phone, online, or in writing. A fraud alert places a “red flag” on your credit reports, alerting potential creditors to take extra precautions before extending credit. Typically, creditors will call you to verify your identity before issuing any credit.
The fraud alert will last for 90 days, but may be renewed on the 91st day for another 90 days. You can continue to renew a fraud alert indefinitely (Tip: Mark it on your calendar!)
An added benefit of a fraud alert is that it entitles you to free copies of your three credit reports each time the fraud alert is established. This is in addition to your right to your free annual credit reports. For more information, visit www.annualcreditreport.com  and http://www.ftc.gov/bcp/edu/microsites/freereports/index.shtml .
Extended fraud alerts. Victims of identity theft and military personnel away from their duty station may be eligible for longer fraud alerts. For information on how to place a fraud alert, see https://www.privacyrights.org/content/identity-theft-what-do-if-it-happens-you#1 .
Free credit monitoring from financial institutions and other organizations. Some banks, credit unions, auto clubs, and other organizations offer free monitoring services with their credit cards or other services. Sometimes, they will use a free basic service as a marketing tool to "upsell" you to a fee-based premium service.
Credit Karma offers free credit monitoring. Their service utilizes TransUnion, one of the three major credit reporting agencies. Credit Karma's advertisers pay for the credit monitoring service. Consumers are not charged for the service and no credit card is required. You should be aware that the other two credit bureaus, Experian and Equifax, are not included in this service. You can sign up at http://www.creditkarma.com/credit-monitoring . (No endorsement implied.) You can also see both your TransUnion and Equifax credit reports and credit scores on this site at no charge.
Credit Sesame also offers free credit monitoring. Their service utilizes Experian, one of the three major credit reporting agencies. Credit Sesame's advertisers pay for
the credit monitoring service. Consumers are not charged for the
service and no credit card is required. You should be aware that the
other two credit bureaus, TransUnion and Equifax, are not included in this service. You can sign up at www.creditsesame.com . (No endorsement implied.)
Data breaches. Victims of data and security breaches are often offered a year or more of of free credit monitoring as “compensation” for the breach. It's important to understand the limitations of such free offers. Make sure that all three credit bureaus are included in the monitoring and that you automatically receive alerts when there is any activity in your credit report.
The PRC believes that identity theft monitoring services are not necessary for many consumers. The free and low-cost alternatives suggested above often provide adequate protection for the typical consumer. However, there may be circumstances where a consumer desires the psychological security of a monitoring service or when particular circumstances might make monitoring desirable.
Tip: Before considering paying for a monitoring service, think about whether a fraud alert or security freeze (described above) might provide better protection at a much lower cost.
Remember that most monitoring services only have the capability to inform you of an identity theft after it occurs. A security freeze can prevent new account fraud before it happens. Monitoring does not actually stop the opening of new accounts. You will just find out about the fraudulent accounts sooner. Monitoring services may provide a false sense of security because there may be holes in coverage. For example, a service may only check with one credit bureau.
If you decide to subscribe to an identity theft monitoring service, be sure to read and understand the product offering carefully. Consider whether the service follows Best Practices for Identity Theft Services:
How Are Services Measuring Up?  (Consumer Federation of America, April 2012).
Here are some things to consider if you decide to pay for an identity theft monitoring service:
- Does the service provide daily, weekly, or monthly credit monitoring? The better services offer daily or even real-time monitoring.
- Does the service provide credit monitoring at all three credit reporting agencies? Monitoring at only one credit bureau provides insufficient protection because typically a potential creditor will only check with one of the three credit reporting agencies before opening a new account. There is no guarantee that the credit issuer will check the one credit bureau that your particular service monitors.
- Does the service provide you with unlimited access to your credit reports?
- Does the service give you unlimited access to your credit scores? Be aware that monitoring services typically do not provide access to your FICO score, which is the industry leader in credit scores. For additional information on credit scores, read “Your Credit Score: How It All Adds Up” at www.privacyrights.org/fs/fs6c-CreditScores.htm .
- Does the service consist primarily of services that you could perform yourself at no cost (for example, fraud alerts, credit card pre-screen opt out, the telemarketing do-not-call list)? See our “Privacy Survival Guide: Take Control of Your Personal Information "
- How does the cost of the service compare with other services? Prices vary tremendously and may or may not be indicative of effectiveness of the service that you will receive or the level of services provided.
- Does the service offer additional monitoring services? Some services include Internet newsgroups, search engines, blogs, chat rooms, public records, and online directories that list consumers’ information.
- Does the service provide any incidental products such as free computer security software?
- What type of assistance, if any, will you receive to recover from identity theft? The nature of this assistance may vary tremendously from one service to another. Some services may only offer you forms (fraud affidavits) to complete. Others may provide you with individualized counseling services. The best services will actually contact creditors, employers, law enforcement agencies, and others as needed to help your identity theft. A few services may also provide legal services for the most complex identity theft problems.
- Is identity theft insurance included and what does it cover (see below)?
The risk of financial loss from identity theft is generally very low. If you report a loss promptly after discovery and you have not done anything to contribute to the loss, it is unlikely that you will have financial responsibility. You may encounter a few costs in documenting your loss, such as postage, notary, and copying costs, but these are likely to be minimal.
The biggest cost will be your time. Most policies will not compensate you for your loss of time. For this reason, it’s unlikely that you need to purchase identity theft insurance.
Some identity theft services include insurance as part of the package. Insurance is a highly regulated product that must be issued by a licensed insurer. If you are obtaining insurance, here are some questions to ask:
- Does the coverage include actual financial losses from the identity theft, the costs of documenting your loss, or both?
- Does the coverage pay you for lost wages?
- Does the coverage include attorney’s fees for legal defense when necessary?
- Does the coverage include thefts committed before the policy’s effective date, but not discovered until afterwards?
- What is the deductible that you must pay before obtaining benefits and services from the insurance policy?
You might also want to check to see if you are already covered by your homeowner’s or renter’s insurance. Or check if your insurer may be able to add coverage for a small annual fee.
8. Are there steps I can take to reduce my risk of identity theft?
Absolutely! We list many consumer tips for reducing your risk of identity theft in our guide “Coping with Identity Theft: Reducing the Risk of Fraud” available at www.privacyrights.org/fs/fs17-it.htm 
Privacy Rights Clearinghouse
- “Paper or Plastic: What Have You Got to Lose?”
- “My Social Security Number: How Secure Is It?”
- “Criminal Identity Theft: What to Do if It Happens to You” www.privacyrights.org/fs/fs17g-CrimIdTheft.htm 
- “Coping with Identity Theft: Reducing the Risk of Fraud”
- Best Practices for Identity Theft Services: How Are Services Measuring Up?  (Consumer Federation of America, April 2012)
- Progress on Identity Theft Services Measuring Up to CFA Best Practices  (Consumer Federation of America, June 2013)
- “Freeze Your Credit File -- Leave ID Thieves Out in the Cold”
- The Federal Trade Commission’s page on free annual credit reports, http://www.ftc.gov/bcp/edu/microsites/freereports/index.shtml 
- Krebs on Security post "Are Credit Monitoring Services Worth It?" http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/ 
Note: The Privacy Rights Clearinghouse does not endorse, recommend, or link to any identity theft monitoring services.