Do Identity-Theft Protection Services Work?

Identity-theft protection services are a hot topic in security circles. Do these services work? Should you use them?

Todd Davis is best known as the CEO of identity-theft protection company LifeLock who used his own Social Security number in his company's advertising as a sign of his confidence in the service. In May, it was widely reported that Davis's identity had been stolen at least 13 times. The controversy over LifeLock's advertising ultimately cost the company $12 million in fines.

Granted, most of us won't plaster our Social Security numbers all over billboards. But real threats exist out there, and it is important to protect your identity. Are online identity-protection services worth the cost? Can you trust them? Are there more-effective ways to protect your personal information without the services of a specialized company? We did some digging, and here's what we found.

How Identity Theft Works

Criminals can steal your identity through a variety of ways, including phishing scams, malware on your PC, and even rooting through your trash for sensitive paper documents. You can defend yourself against such attacks by keeping an eye out for phishing tactics, running antimalware utilities, and shredding documents.

One method of identity theft that you can't directly guard against is a data breach against a company--such as a bank--that you do business with. According to the Identity Theft Resource Center, 498 such breaches occurred in 2009. Often criminals will sell personal information harvested from data breaches to other crooks on online black markets. Criminals could use your identity for anything from opening bank or credit card accounts to seeking medical care using your name.

To make matters worse, laws requiring companies to disclose data breaches are spotty: Some states have tough reporting laws, but no national standard exists. In other words, you could do everything right, and still have your identity stolen without realizing it. No wonder there's a market for identity-theft protection services.

What ID Protection Services Do (and Don't Do)

Identity-theft protection services typically monitor your credit or public records for any suspicious charges, or offer other identity-theft safeguards, for a monthly fee. In some cases they provide services to help clean up the mess left behind in the wake of identity theft and assist in rebuilding your credit. Banks frequently offer several degrees of identity-theft protection to their customers, as well.

You won't find any hard and fast guidelines about what to look for if you decide to buy into an identity-theft protection service. "Consumers need to do their homework," says Jay Foley, executive director with the Identity Theft Resource Center. Before signing up, you should ask what these companies offer, and evaluate whether their services fit your needs.

According to Privacy Rights Clearinghouse, identity-theft protection services don't monitor certain types of identity theft, such as prior instances of identity theft, Social Security number fraud (a point of contention with the LifeLock advertising), debit/check card fraud, criminal identity fraud (that is, a criminal assumes your identity when arrested), and medical fraud (a criminal assumes your identity when seeking medical attention). Paul Stephens, director of policy and advocacy with Privacy Rights Clearninghouse, notes that these sorts of crimes "are more difficult to recover from than financial identity theft."

Privacy Rights Clearninghouse provides a list of the sorts of services you should look for in an ID-theft protection service. In particular, you should determine what sorts of credit-monitoring services the company provides (which credit bureaus it gets reports from, how often it obtains reports, whether you can have unlimited access to your credit reports and scores), whether the company provides services you can't do by yourself or find elsewhere, and what kinds of extra services and insurance the company offers.

You should also look for whether a company performs additional identity monitoring. For example, does it track whether someone is using your address, or is receiving medical care under your name? "Do [ID-theft protection services] do more than monitor your credit? If they can say 'yes,' then maybe they're worth some value," says Foley.

As for reputation, Foley says to "look for those [services] on the wrong side of the FTC." Do a Web search to see if any complaints have been filed with the Federal Trade Commission about the company you're considering. Additionally, the Better Business Bureau can be a good place to get an idea of problems that real people have had with a given company, as well as to learn of any actions the government has taken against a company for deceptive or anticonsumer practices.

Should You Use Them?

In general, identity-theft protection companies provide little that you couldn't do yourself for free, says Foley. Instead, for a monthly fee, these companies provide the convenience of doing the legwork for you. Keeping tabs on your identity yourself can be a time-consuming, labor-intensive process.

You should keep in mind that these companies aren't end-all, be-all protection services. Stephens says that not all identity-theft protection services offer credit monitoring, for example--and when they do, they may pull credit reports from only one of the three major credit bureaus.

Protect Yourself...By Yourself

The good news is that you don't have to depend on a third-party identity-theft service to protect yourself. As the FTC notes, you have a number of ways to shield yourself from identity theft without paying for a service.

The easiest way is to keep a close eye on your bank and credit card statements. Take a thorough look at the charges; if anything seems suspicious, call your bank or credit card provider.

Also, be sure to get one credit report from each of the major credit bureaus every year. Doing so is free at If you suspect that your identity has been stolen, you'll be able to place a fraud alert on your credit report that can help deter thieves from opening credit card accounts in your name. A regular fraud alert lasts for 90 days; an extended fraud alert persists for seven years. Additionally, you can put a freeze on your credit report to "lock" your credit if it has been compromised.

Financial institutions typically offer some credit-monitoring services, usually for a monthly fee. Your credit card provider may also have some sort of credit monitoring, as do some AAA auto-club chapters. Stephens notes that these services are usually more cost-effective than subscribing to an ID-theft protection service.

A proactive measure that you can take is to use virtual credit card numbers for online payments. These virtual credit card numbers, available from many banks, are one-time-use numbers that you enter in place of your actual credit card information. If a thief gets ahold of the virtual credit card number, it's useless to them. For more, see Erik Larkin's "Go Virtual for Safer Online Shopping."

Beyond credit reporting, pay attention to other areas of your life. For example, be on the lookout for medical benefits payouts for treatment you've never received. If you're contacted about payment for a phone or utility account that you've never opened, there's a good chance that your identity has been compromised. If this happens to you, the FTC recommends that you file a police report.

For more information on how to protect yourself from identity theft, as well as how to recover from identity theft, see the FTC's identity-theft microsite.

This story, "Do Identity-Theft Protection Services Work?" was originally published by PCWorld.

ITWorld DealPost: The best in tech deals and discounts.
Shop Tech Products at Amazon