The burgeoning business of identity protection
The data breach notification letters came in waves over the past year. There was JPMorgan Chase, then Home Depot, and Anthem. As a result of those, some 204 million consumers had personally identifiable information exposed to criminal hackers, raising the specter of identity fraud for roughly 65 percent of the American population.
These kinds of hacks have become an unfortunate side effect of our Digital Age, leading many anxious consumers to search out new ways to guard against the scourge of identity theft. It’s this collective concern that is fueling a tremendous growth in the identity protection services from companies such as LifeLock, ezShield, and IdentityForce.
Over the past year, consumers spent $1.4 billion in ID protection subscriptions purchased directly from providers, with 16.7 million consumers holding a subscription at some point in the past year, according to analysts with Javelin Strategy and Research, a business research firm.
But can these services really guard consumers in the face of increasingly sophisticated and large-scale criminal hacks? Is the protection they offer really worth the $10, $20, or $30 monthly subscription fees these companies charge to monitor someone’s sensitive personal information?
Well, it depends, say security and privacy experts.
“I like to look at them essentially as concierge services," says Paul Stephens, director of policy and advocacy for the Privacy Rights Clearinghouse, a nonprofit consumer rights group, explaining that many people can replicate the services with a do-it-yourself approach. "Some do offer enhancements to the services that perhaps might be useful to individuals in certain circumstances, but there are alternatives that individuals can use that either would be no cost or low cost if they’re looking to save money."
For example, when it comes to monitoring credit reports, Mr. Stephens says that consumers can take advantage of the free annual report each reporting agency must offer them – it's especially effective if they ask a different agency to check every four months. And they can fill in the gaps with advertising-supported monitoring services such as Credit Karma or Credit Sesame for no cost. Additionally, consumers who are truly worried about fraud and don't need frequent or immediate access to new lines of credit can also consider gaining some cheap peace of mind by working with the reporting agencies to freeze their credit reports.
"The nice thing about this is that it locks down your credit report permanently making financial identity theft virtually impossible," he says, explaining that it only costs $10 per credit reporting agency to initiate a freeze. "It’s really the best way to secure yourself from financial identity theft. There is a downside to it and that is in the event you apply for credit you have to go through the process of unfreezing the freeze, which can be a little bit of a nuisance."
But that nuisance may be a big deterrent for many people who find it impractical to unfreeze and refreeze their credit every time they need to access their credit report to purchase real estate, cars and appliances, or to just open a store credit card.
Plus, the identity protection services market has matured to the point where many of the high end services offer lots of added value beyond what a consumer could accomplish on their own with research and free reporting tools, says Al Pascual, director of the fraud and security practice at Javelin. The consolidation of information across all accounts and reporting agencies has long been a big draw – and now many service companies are building on that, through mobile alerting and reporting tools that raise the bar on keeping customers easily informed about what's going on with their identity information.
Additionally, Mr. Pascual says that many services also monitor certain sources of information that may not be available to the typical consumer.
"They may check to see whether or not your data is being bought and sold in the underground or if it is available in the 'dark Web' and places that you're not going to be able to monitor as an individual," he says. "These services are a way to help you cover yourself in the event that you're impacted by a breach that you're not notified of."
What's more, one of the big benefits of having the more expensive identity protection services is the backstop of remediation services should the bad guys actually succeed in any aspect of identity fraud. Individuals can manage the damage after the bad guys have wreaked havoc – but it isn't easy. In some cases, it can feel like a full-time job, says Adam Levin, founder of identity protection services firm IDT911.
"Yeah, you can do it yourself, but if you’re going to do it yourself assume you’re going to have no life," says Mr. Levin, who explains that one of the big perks of his company's services is that its reps will chase down relevant information.
IDT911's model is interesting, though, in that it actually doesn't sell direct to customers. Instead, it sells to companies who either resell the services to customers or offer them as a perk to customers or employees. This model should offer a lesson to customers – namely that it may be possible to get the premier benefits of identity protection services without paying for it personally. Before signing up for individual coverage, it pays to look into whether your insurance company, bank or employer offers a service at zero or little cost.
Regardless, Levin suggests consumers check out a resource offered by the Consumer Federation of America, IDTheftInfo.org, which offers a consolidated view of pricing as well as questions they should ask themselves to determine what level of coverage they really need to cost-effectively protect their identities.
Passcode's writers produced this package of stories for the ID360 conference on the identity economy, hosted by the University of Texas at Austin's Center for Identity. Click here to see the full package.
