6 things to know before buying identity-theft protection
By Dana Dratch | Published: July 8, 2015
As data breaches and online account hacks routinely make headlines, many consumers are turning to services that provide identity-theft protection.
"Your information is valuable, just like your cash or your jewelry," says Eva Casey Velasquez, president and CEO of the Identity Theft Resource Center. "So treat it like that."
Steven Toporoff, attorney in the division of privacy and identity protection at the Federal Trade Commission, says when you shop for these services, consider what they guard against. Then, compare services based on costs and what you get for the money. "It's almost like shopping for insurance," he says.
If you're considering paying for a service that offers identity-theft protection -- or even if you plan to take a free DIY approach -- here are six things it pays to know:
1: Nothing is foolproof.
No matter what option you choose, you still are vulnerable to identity theft, says Susan Grant, director of consumer protection and privacy for the Consumer Federation of America. "It's really important for consumers to realize that no service can absolutely protect them from becoming an identity-theft victim," she says.
However, even if crooks do steal your identity, protection services can alert you more quickly, and -- depending on the service -- provide some assistance in resolving problems once they occur, Grant says.
Cost-saving tip: You may have access to free identity-theft protection or credit monitoring through your employee benefits program, credit union or membership in organizations such as AAA.
2: Different tactics combat different kinds of ID theft.
Some companies offer services that address every kind of identity theft. Others may focus on a specific kind of crime, such as identity theft that arises as the result of a data breach. Toporoff urges you to make sure the service's protection matches your situation. "Having a Social Security number compromised is very different from having a credit card compromised," he says.
Most identity fraud involves criminals using existing cards, says Paul Stephens, director of privacy and advocacy for the Privacy Rights Clearinghouse. But credit monitoring -- a staple of services that offer identity-theft protection -- isn't an effective strategy for catching that type of abuse, he says.
Credit monitoring also is unlikely to detect someone using your identity for purposes that don't show up on a credit history. Grant says such activities might include making claims on your health insurance or using your Social Security number to get a job, open a bank account or take out a payday loan. On the other hand, credit monitoring will detect when someone uses your credit history or score to open new credit accounts or take out new loans, she says.
DIY strategy: Take advantage of the layers of security and alerts that your bank, credit union and cards already offer, says Velasquez, whose center is a nonprofit educational organization that helps guide consumers dealing with identity theft.
Three steps to take:
- Arrange email alerts for online transactions, or purchases over a certain amount. While flagged transactions "won't necessarily be denied," alerts give you real-time feedback, Stephens says.
- When possible, set spending caps for transactions on credit and debit cards, says Toporoff.
- Add personal identification numbers to checking and savings accounts -- no PIN, no access. Some institutions also let you limit the amount that can be wired from accounts without your being physically present, Velasquez says.
3: Throw a broad net.
Choosing a service that monitors all of your credit reports -- rather than just one or two -- can pay off. Stephens says if a crook opens an account in your name, it may not show up on all of your reports, or it may be months before it hits all three reports.
Finding a service that monitors all three is "the gold standard," Velasquez says. She also urges you to find out how often the company checks credit histories. The credit reporting agencies generally update these histories monthly.
DIY strategy: If you see an unexpected score drop, it could mean an uninvited guest is using your credit information. You can do your own credit monitoring for free. AnnualCreditReport.com, the website operated by the credit reporting agencies, allows you to order one free report from each of the agencies annually.
In addition, many major card issuers, at the urging of the Obama administration and the Consumer Financial Protection Bureau, have begun giving consumers a free look at their credit scores, usually as part of their monthly statements. (See "Cards with free credit scores.") Viewing bank accounts and credit accounts regularly online can catch telltale ID-theft clues -- such as a change of address, credit-line increase or escalating balance.
A fraud alert asks potential creditors to take extra steps to verify the identity of anyone trying to open new accounts with your credit. It also entitles you to additional free copies of your three credit reports. A regular alert lasts for 90 days, but can be renewed indefinitely. Active members of the military can request a one-year fraud alert. Victims of identity theft or data breaches can get an extended alert good for seven years, according to the FTC website.
A credit freeze literally locks your credit history. No one (except existing creditors) can view it or check your score. Since most lenders won't grant credit without first checking your credit report, this effectively shuts down anyone trying to open new accounts in your name, says Joe Ridout, consumer services manager with Consumer Action.
The downsides: Alerts asks potential lenders to be more careful, but don't require them to do so. Some creditors ignore the alert, says Stephens. And freezes shut you out, too. If you need someone -- such as a potential employer, insurance agent or lender -- to see your credit, you'll have to "thaw" it -- and likely have to pay for the privilege.
DIY strategy: You can request fraud alerts and credit freezes on your own. Fraud alerts are free. With credit freezes and thaws, there may be a small fee (often about $10) depending on your situation and state, says Ridout.
5: Consider hiring a 'Dark Web' troll.
Some companies will monitor the "dark Web" (or "deep Web") -- that hard-to-search Internet underbelly where criminals traffic in stolen goods -- for your personal data and account information, says Stephens.
This is one service you likely can't duplicate on your own, says Toporoff. "The average person won't know if personal information is being traded out there," he says. Although choosing a service that sifts through parts of the Deep Web "might be a useful service," it's difficult for consumers to understand, evaluate or confirm what they're getting for their money, Stephens says.
There's also the practical question of just how helpful it is, according to several consumer advocates. For instance, knowing that your Social Security number is actively being marketed "would help you be more vigilant," says Grant. But even identity-theft-protection companies can't keep personal financial information out of these online dark alleys, remove it if it appears there, or stop its sale, she says.
6: Know what will happen if there's a problem.
Promotional come-ons for identity theft protection services make big promises. But the secret to getting what you need is to drill down beyond the marketing to find out what happens if a problem is detected.
Some questions to consider:
- How quickly after discovering trouble (or potential trouble) will the service contact you?
- How does the company help straighten out the problems resulting from identity theft? "Do they send you a bunch of forms and checklists, or will they go out there and do all that work for you?" Stephens asks.
- Does the company handle resolutions in-house, or farm them out? Will one person manage everything, and how accessible will that individual be?
- If the service includes an insurance policy, under what circumstances can you get monetary compensation? Does it reimburse you strictly for financial losses, or will it also cover the cost of time lost straightening out identity theft?
DIY strategy: Identity-theft losses might be covered under your existing homeowner's or renter's insurance policy, says Stephens. Or you may be able to inexpensively add the coverage to your policy, he says.
- DIY credit card arbitration: You may be able to opt out – Consumers can preserve their right to go to court instead of private arbitration in many cases by going through and opt-out process ...
- CFPB rule: Consumers should be able to band together and sue – Banks, GOP oppose measure that would end "mandatory arbitration" clauses that prevented class-action suits ...
- Bluesnarfing is newest card fraud at gas pumps and ATMs – With a skimmer and Bluetooth technology, fraudsters can sit nearby and intercept your payment transaction details ...