ITRC Fact Sheet 132
Identity Theft Products
This fact sheet covers:
- Credit Monitoring Services
- Identity Monitoring Services
- Credit Freeze Products
- Data Sweep Services
- Secure Payment Agents (SPAs)
- Identity Theft Insurance
The Identity Theft Resource Center receives numerous inquiries from consumers regarding identity theft products or services available for purchase. While ITRC does not endorse any specific product or service, this document has been created to help consumers understand various products, their benefits and limitations, and what items should be included. Most of these services can be done by an industrious and identity theft-aware consumer. For instance, you can check your own credit reports via the free federal program: www.annualcreditreport.com, please refer to ITRC Fact Sheet 125.
However, if you have the discretionary money and want to avail yourself of consumer products, this guide will help you understand features that should be provided.
Identity theft is not just a financial crime. Therefore, it is ITRC‘s position that no one product can fully PROTECT you from identity theft and that any advertisement stating it provides a complete protection program is misleading and fraudulent. For example, none of these products can stop a criminal from using your information when being ticketed by a police officer. Additionally, they cannot stop someone from using your Social Security number to get a job or apply for government benefits.
Using the word “protect”, implies the ability to proactively stop a crime before it happens. Some of these products and services are reactive and only let you know a crime has occurred after the fact.
As you consider the following services, ITRC would like to remind you to shop carefully, read contracts and privacy policies, and check out companies with the Better Business Bureau or state Attorneys General. You can also do an Internet search for complaints about specific companies or services.
Credit Monitoring Services:
Credit monitoring is a service which allows consumers to be advised about changes on their credit reports, and/or to view a summary of their credit report upon request. This service may monitor only one credit report or it could monitor reports from all the major Credit Reporting Agencies (i.e. Experian, Equifax and TransUnion). You should be aware that all three reports are not identical.
If you wish to sign up for a credit monitoring service, you should review and evaluate the various options available to determine the product and/or service that best meets your needs.
To date, credit monitoring products only help in a limited area of financial identity theft, and do not address the other forms of identity theft, such as criminal, governmental services, etc. They also do not indicate account takeover or the misuse of existing credit cards. In addition, new bank accounts, utility accounts, and some other types of financial accounts may not appear on your credit report until they go to collection.
Please beware of the following:
- The credit monitoring information may not be current. Some credit issuers may not provide new credit application information or collection actions to the three credit reporting agencies in real time.
- Credit monitoring is dependent upon credit issuers providing new application information to the CRAs. The reality is that not all credit issuers report to the CRAs.
- A report that only has information from one of the three CRAs is incomplete. It must be a tri-report from all three CRAs. Otherwise, it may not show all the pending applications and open accounts.
- Credit monitoring is a reactive process, not a proactive process.
Identity Monitoring Services:
These new services go beyond traditional credit monitoring by including additional areas where fraudulent activity may be indicated. In some cases, these may be more proactive in alerting you to fraudulent activity in real time. Each service is slightly different.
Additional areas may include:
- monitoring for items such as address changes
- identifying unusual personal activity (such as applying for several lines of credit with auto dealers in the same week)
- scanning the Internet for exposed account information
- screening for other items that may indicate something is awry.
Some companies calculate identity risk by looking for any suspicious or unusual relationships among billions of basic identity elements. Others include credit monitoring and some of the additional items mentioned above. Look for a service that notifies you quickly of any developing problem.
Credit Freeze Products:
A credit or security freeze is a stronger measure than a fraud alert. It literally locks your credit report from viewing for the purpose of new lines of credit, and for some employment and tenancy. When in place, potential creditors, insurance companies, landlords and some employers doing financial background checks may be told that your report is unavailable for viewing. The price varies from state to state and is usually free for victims of identity theft (Please see our State and Local Resource Map for your states freeze law). This product is typically added to other identity theft services. For more information about Credit Freezes see ITRC Fact Sheet 124.
Ask the following questions?
- What are costs and fees associated with the service?
- What is the company’s reputation?
- What services will they provide?
- Is the cancellation policy reasonable?
- Will the credit freeze product provider contact you at the time of credit application?
- How long does it take this product provider to activate your freeze?
- Is a “live person” readily available by phone if you have questions?
- What help is provided if you find you are an identity theft victim due to a failure to observe a freeze?
- Do they make overreaching claims, such as “our product can prevent identity theft?”
Victim Resolution or Restitution Products:
By definition, victim resolution or restitution is the process by which a victim clears all fraudulent records created by an identity thief.
There are companies that will do all the restoration work for you. Make sure the company will cover any identity theft case that unknowingly existed before you purchased the program. A contract clause denying coverage for a pre-existing identity theft case is the one that most consumers discover after the fact and then find themselves without assistance.
Ask about the following items:
- What are the fees? What services are provided?
- Do they cover all types of identity theft? (Financial, criminal, governmental services, etc.)
- Do you need to sign a power of attorney?
- Do you need to provide your Social Security numbers and financial account numbers to this company?
- What is the process they use to restore your good name?
- What type of training do their investigators undergo?
- What is their reputation for getting the job done completely and effectively?
- What is their guarantee? Is there a refund policy?
ITRC cannot stress enough the need for victims to do their homework as part of your “buyer beware” due diligence.
Note: There are many state and non-profit organizations that will assist victims WITHOUT charge. These organizations will guide victims through the process, step by step, and will even provide letter forms to use.
Data Sweep Services:
This type of company checks the Internet for listings of your personal identifying information. While names, Social Security numbers and financial records are critical to identity theft, other pieces of information, such as your email address, also expose you to spammers and identity thieves. Once personal information is detected, these services will provide an alert so that steps may be taken to remove it.
Questions to ask these companies include:
- What is the price? What other products does it include or can you buy it as a stand-alone product?
- What information do they search for? Does it include all or just some of these items: name, Social Security Number, email address, telephone number, financial records, and home address?
- How frequently do they do a sweep? “Real time” is preferable.
- How quickly do they notify you of any listing and how do they notify you?
- How persistent are they in making sure you received their notification?
- Do they allow a trial period for you to decide if you want to continue with this product? Many companies will allow you at least a one-month trial period.
- What is their background and expertise in data sweeping? Do they interact with law enforcement agencies? That is a plus.
Secure Payment Agents (SPAs):
A “Secure Payment Agent”, as defined by ITRC, allows the consumer to control the use of all their sensitive personal information whether shopping, paying bills online, or registering at websites. A SPA has the ability to replace all of the user’s real personal information with anonymous data that becomes useless after a transaction and cannot be tracked back to the user. The following list includes items that ITRC has identified as some of the prerequisites SPAs should include:
- Replaces the consumer’s real personal identifying and financial information with anonymous data
that is untraceable back to the consumer
- Eliminates phishing both when visiting websites and receiving incoming email
- Verifies both consumer and device before allowing access to or use of the Secure Payment Agent
- Stores user data so it becomes useless if the Secure Payment Agent’s data base storage system is breached
- Merchants must be able to send, and consumers to receive, purchase/shipment confirmations without delay, extra steps or the use of supplemental devices.
- Authentication method must be “Multi-Authentication” using attributes of:
- Who You Are
- What You Have
- What You Know
Identity Theft Insurance:
These are insurance programs, or add-ons to existing policies, that help replace real expenses incurred by the victims of identity theft. Look for the following items:
- Low cost premiums - $25-$50 annually is typical.
- A low deductible amount. If the deductible amount is too large, your expenses may not be enough to justify a claim.
- Should cover lost wages. Note: This should include salaried employees and those who are self-employed. It should not require that you use any earned sick or vacation time first. It should reimburse you for sick or vacation time you have to use for your case.
- Includes legitimate legal expenses directly related to recovering your good name
- Includes out-of-pocket expenses
- Make sure the company will cover any identity theft case that unknowingly existed before you purchased the program. A contract clause denying coverage for a pre-existing identity theft case is the one that most consumers discover after the fact and then find themselves without assistance.
- Verification that any claims on the identity theft insurance do not affect any other policies you have with the same company. This is very important since some identity theft policies are add-ons on homeowner’s insurance. If a claim on the identity theft policy raises your rates for a related home-owners or other policy, it may not be cost effective.
This fact sheet should not be used in lieu of legal advice. Any requests to reproduce this material, other than by individual victims for their
own use, should be directed to
Copyright September 2009, Identity Theft Resource Center ® Created by ITRC staff
This project was supported by Grant No. 2007-VF-GX-K038 awarded by the Office for Victims of Crime, Office of Justice Programs, U.S. Department of Justice. Points of view in this document are those of the ITRC and do not necessarily represent the official position or policies of the U.S. Department of Justice