Is identity theft protection worth it, judged on published numbers

The number that answers the question, and where it comes from

In 2015 the United States Office of Personnel Management was breached, and the government bought identity theft services for the people affected. That makes it the largest single group of subscribers anybody has ever measured, and the Government Accountability Office measured it.

The figures, from the GAO’s March 2019 report, with the two dates the report itself attaches to them: “As of November 30, 2018, the Office of Personnel Management (OPM) had obligated about $421 million for a suite of credit and identity monitoring, insurance, and identity restoration services to offer to the approximately 22 million individuals affected by its 2015 data breaches. As of September 30, 2018, about 3 million had used the services and approximately 61 individuals had received payouts from insurance claims, for an average of $1,800 per claim.”

Sixty-one people, out of about three million using the service. That is the insurance part — the part sold as up to a million dollars of cover — doing what it does in practice over three years.

The GAO is blunter still about whether any of it works: “GAO’s review did not identify any studies that analyzed whether consumers who sign up for or purchase identity theft services were less subject to identity theft or detected financial or other fraud more or less quickly than those who monitored their own accounts for free.” And it summarises the limit: such services “do not prevent fraud from happening in the first place”.

What a subscription is made of, part by part

“Identity theft protection” is a bundle of four different things, and they are worth separating because they do not stand or fall together. The GAO’s 2017 report describes each one.

Credit monitoring. It “helps detect new-account fraud (that is, the opening of new unauthorized accounts) by alerting users, but it does not prevent such fraud or address existing-account fraud, such as misuse of a stolen credit card number”. That single sentence contains both halves of the answer: it tells you afterwards, and it says nothing about the card in your pocket being used.

Identity monitoring. It “can alert consumers to misuse of certain personal information by monitoring sources such as public records or illicit websites, but its effectiveness in mitigating identity theft is unclear”. This is the part usually advertised as scanning the dark web, and “unclear” is the government’s word, not this page’s.

Identity restoration. The variation here is the thing to check before buying: it “seeks to remediate the effects of identity theft, but the level of service varies: some providers offer hands-on assistance, such as interacting with creditors on the consumer’s behalf, while others largely provide self-help information, which is of more limited benefit”. Hands-on help with creditors is genuinely valuable; a set of template letters is what IdentityTheft.gov gives away.

Identity theft insurance. It “covers certain expenses related to the process of remediating identity theft but generally excludes direct financial losses, and the number and dollar amount of claims has been low”. Expenses, not losses: the legal fees and the lost wages, not the money that was taken.

And a limit that applies to all four: these services “typically do not address some types of threats, such as medical identity or tax refund fraud”.

What the same protection costs when you do it yourself

The alternative the GAO names is not vigilance, it is a specific free mechanism: “a credit freeze, which prevents one type of fraud. A freeze restricts businesses from accessing a person’s credit report — and can prevent the illicit opening of a new account or loan in the person’s name.”

The FTC’s description of it is short and worth reading exactly: “When a credit freeze is in place, nobody can open a new credit account in your name. There’s no cost to place or lift a credit freeze, and it doesn’t affect your credit score.” And it removes the usual reason for waiting: “You don’t have to wait for your Social Security number or other information to be exposed in a data breach or misused by an identity thief to get a credit freeze. Anyone can do it, any time.”

Where the two part company. A freeze and a fraud alert are contacted differently. For a freeze the FTC says: “Contact all three of the credit bureaus — Equifax, Experian, and TransUnion.” For an initial fraud alert it says the opposite — “Contact one of the three credit bureaus” — and spells out what that one bureau then owes you: “You don’t have to contact all three. The credit bureau you contact must tell the other two to place an initial fraud alert on your credit report.” One freeze at one bureau leaves the other two open.

The freeze has one consequence the FTC states plainly: “While a credit freeze is in place, nobody can open a new credit account in your name, including you.” If you are about to apply for something, you lift it at the bureau that lender uses and put it back afterwards. It “lasts until you lift it”, and an initial fraud alert “lasts one year, but you can renew it”.

And the recovery half. IdentityTheft.gov is the FTC’s own service, and its description of itself is three steps: tell it what happened, “Get a recovery plan” built from that, and then, if you create an account, it will “walk you through each recovery step, update your plan as needed, track your progress, and pre-fill forms and letters for you”. That is the paid restoration feature, in its self-help form, from the agency that regulates the companies selling it.

When paying for it is a reasonable decision anyway

None of the above says never pay. It says know what you are buying, and there are situations where a subscription is a sensible answer to a real constraint.

When somebody else is paying. The GAO notes that after a breach the affected people are often offered the services free, and records that experts consulted said “consumers could sign up for such services if offered for free”. If it costs you nothing, the argument against it is only about attention.

When what you want is the restoration, not the monitoring. The hands-on version — somebody dealing with creditors on your behalf — is a real service with a real cost of delivery. The question to ask before subscribing is which version this provider sells, because the GAO says the range runs from that to self-help information.

When the alternative is doing nothing. A freeze you never place protects nobody. A subscription is a way of buying the intention, and that is not nothing — it is just an expensive way to buy twenty minutes of admin.

What the evidence does not support is the framing the category is sold with: that a monthly fee prevents identity theft. It does not. The GAO’s sentence is the one to keep: these services “do not prevent fraud from happening in the first place”.