How Useful Are Identity Theft Services?

Many people purchase identity theft services—or receive them free when their information is compromised in an organization’s data breach. These services typically include four components: credit monitoring, identity monitoring, identity restoration, and identity theft insurance. For April’s Financial Literacy Month, read about the benefits and limitations of identity theft services, and how federal agencies are using them, and listen to Lawrance Evans, a director in our Financial Markets and Community Investment team, discuss the issue:

Credit monitoring pros and cons

Credit monitoring can alert you when someone has fraudulently opened a new credit account in your name. But despite some of the marketing hype, credit monitoring is limited in “protecting” your identity because it can only detect fraud, rather than prevent it.

Also, many people may not realize that credit monitoring does not alert you to fraudulent charges made on a credit card you already have.

Be aware that there are free and low-cost alternatives to credit monitoring (as shown in the table) to address identity theft, and choose what’s right for you.

(Excerpted from GAO-17-254)

What about the other services?

• Identity monitoring services monitor sources other than credit reports, alerting you when your identity appears in things like arrest records, sex offender registries, change-of-address requests, or black market websites where criminals buy and sell personal information. However, it’s unclear how effective this is in actually mitigating identity theft.
• Identity restoration assists you in recovering from identity theft, but the level of service provided can vary. Some companies provide hands-on assistance—for example, notifying government agencies, reviewing public records to determine the extent of the fraud, and working with credit card companies and collection agencies on your behalf. Other companies may only provide advice on what actions you should take on your own.
• Identity theft insurance reimburses you for out-of-pocket expenses related to the process of restoring your identity and credit record. These expenses include things like postage and notary fees; costs related to obtaining credit reports, implementing credit freezes, or replacing documents; and attorney fees. The insurance generally doesn’t cover direct financial losses. In practice, the value to consumers of identity theft insurance is limited—largely because the process of resolving identity theft typically does not require significant expenses. We found that the number and dollar amounts of identity theft insurance claims appear to be quite low.

Using taxpayer dollars wisely? Many federal agencies that have had data breaches have offered identity theft services to affected individuals. These services can be costly—the Office of Personnel Management alone has spent about $240 million to provide them to current and former employees after their personal information was compromised in a couple of breaches. We made several recommendations to help ensure that federal agencies are spending their money wisely with regard to identity theft services. For example, we recommended that the federal government pay more attention to assessing the actual effectiveness of identity theft services before purchasing them. We also recommended that the federal government address duplication—that is, cases where federal employees are offered identity theft services from two different agencies that had data breaches. More identity theft information and help The Federal Trade Commission also has information on how you can prevent and recover from identity theft.

---

• Questions on the content of this post? Contact Lawrance Evans, Jr., at evansl@gao.gov.
• Comments on the WatchBlog? Contact blog@gao.gov.