On the heels of the major security breach at Equifax, millions of Americans are considering signing up for identity and credit monitoring. Equifax is even offering its own version, called TrustedID Premier, for free to all U.S. consumers for a year.
Free credit and identity monitoring has become the salve that companies and government agencies dole out to consumers in the days after a security breach. When personnel records at the U.S. Office of Personnel Management were compromised in 2015, the government pledged three years of free identity monitoring to those affected.
But there hasn’t been much research into whether these solutions are actually helpful, or if there are meaningful differences between the 60 or so companies that sell them. Little is known about the methods and algorithms that each company uses to search for stolen information on the dark web, for example, which makes it hard to compare them.
In March, the U.S. Government Accountability Office issued a 70-page report [PDF] examining credit and identity monitoring services. Of identity monitoring, the report said “its effectiveness in mitigating identity theft is unclear.”
“We didn’t get a lot of clarity in that space, in terms of how effective each individual entity offering these services might be,” says Lawrance Evans, a director for financial markets and community investment at the U.S. Government Accountability Office. “We got the sense there could be significant differences across service providers.”
Credit monitoring alerts consumers to any changes in their credit reports held by the three major U.S. credit bureaus—Experian, Equifax, and TransUnion. Identity monitoring uses algorithms or other techniques to trawl websites for social security numbers, dates of birth, addresses, and other information stolen from consumers.
In the case of identity monitoring, companies are trying to hit a moving target by scanning the dark web for websites known to deal in stolen identities. “The problem there is that nobody knows how many websites there are, and how many these companies are monitoring,” says Jeff Blyskal, a senior editor at Consumer Reports. “It’s kind of catch-as-catch-can, based on the technology.”
After a year, the services provided by Equifax will expire, and consumers affected in the latest breach will have to decide whether to pay fees to keep it. For consumers, identity and credit monitoring services typically cost between $5 and $30 a month. The GAO report noted that two of the largest providers claimed to have a combined total of 5.4 million customers in 2015. “Over the years, we've said that these services are not really worth it,” says Blyskal.
Aside from not being able to gauge their effectiveness, many consumers may be confused about what they are actually signing up for in the first place. The terms used by the industry can be confusing. To help, we asked Evans, Blyskal, and Jocelyn Baird, an associate editor at NextAdvisor.com, to help us dispel some common misconceptions about credit and identity monitoring:
Identity theft insurance will reimburse the money in your checking or retirement account when someone steals your identity and drains it.
In most cases, identity theft insurance does not cover direct financial losses that occur as a result of a stolen identity. Rather, it covers the costs of dealing with the problem and reclaiming your identity. This may include attorney’s fees, charges for photocopying or mailing paperwork, lost wages for any time you took off from work to solve the case, and the cost of a new passport.
Some companies, including Lifelock and Identity Guard, will reimburse customers for stolen funds up to a limit stated in their plan. Equifax’s TrustedID Premier plan that was offered to victims of its breach does not. If this is important to you, it’s best to check that it’s explicitly included in the plan when you sign up.
And you probably don’t need buy a platinum $5 million identity theft insurance plan. The vast majority of identity theft insurance claims that customers file to cover the expenses of dealing with identity theft are for less than a thousand dollars. When companies or government agencies offer free $1 million and $5 million coverage to victims following a breach, those victims might as well sign up, but only a tiny fraction of the pledged coverage is likely to ever be used.
Credit monitoring will stop a thief from racking up charges on my credit card.
Credit monitoring services sold in the U.S. generally keep an eye on your credit at three major credit bureaus: Experian, Equifax, and TransUnion. They are looking for updates from banks, credit card providers, or loan distributors that have opened a new line of credit in your name and reported that fact back to the bureau. They flag these instances so that a customer can review them and take action if they did not request new credit themselves.
But all of this applies only to new lines of credit. It has nothing to do with the accounts you currently hold, including credit cards, investment accounts, and bank accounts. Fraudulent charges to these accounts will not be noted by credit monitoring services, because there is no new line of credit required.
The good news is that many credit card providers excuse customers from paying fraudulent fees, and U.S. legislation also limits the amount a customer can be required to pay if fraudulent activity occurs in one of their accounts.
I’m going to have to pay for credit or identity monitoring for the rest of my life.
The best ways to protect yourself are things you can do for free or low cost, Baird says. Once a year, U.S. citizens can request a free credit report from each of the three major credit bureaus at annualcreditreport.com, and review it for any red flags. (A warning: I tried to check mine and received a notice that the site is experiencing a heavy volume of requests due to the Equifax hack, and told me to check back later).
Baird also recommends paying $5 to $10 fee to place a credit freeze on your report at each of the three bureaus, which will prevent the bureaus from sharing it with any creditor wishing to issue a line of credit in your name, until you unfreeze it. And if you are a victim of identity theft, the U.S. Federal Trade Commission has a website with step-by-step plans to help you restore your identity.
Blyskal also suggests putting a fraud alert on your credit report at all bureaus by contacting any one bureau. This requires any creditor attempting to issue credit in your name to contact you to verify your identity. The alert can be renewed every 90 days. Placing or renewing an alert also qualifies you for another free credit report from each agency, in addition to the one you can access through annualcreditreport.com. “You should never really pay for a credit report anymore,” he says.
Credit and identity monitoring protects me against identity theft.
Several types of identity theft and fraud are simply not captured by credit or identity monitoring services. These include tax refund fraud, in which a person uses your social security number to file taxes on your behalf and claim any refund. To prevent this, Baird recommends filing your 2017 taxes as early as possible.
These services also won’t capture medical fraud, in which someone files an insurance claim based on your information. And most services cannot alert you to payday loans that were taken out in your name.
And at the end of the day, even the best services can really only alert you that your information has been stolen or used. They can’t prevent the theft in the first place, or barge in and prosecute thieves on your behalf. “At best, it detects and alerts,” says Evans.