Debunking the hype over ID theft

Almost 50 million people subscribed to some form of identity-theft protection in 2010. Those services, which cost about $120 to $300 a year, promise to protect your ID by monitoring your credit reports 24/7, scouring "black-market chat rooms" for your personal information, removing your name from marketing lists, and filing fraud alerts. Some throw in up to $1 million in insurance.

More of these pitches are coming from banks, which account for more than half of the $3.5 billion a year spent on ID-theft protection subscriptions. In a sense, consumers who buy this protection from their banks are helping to foot the bill for services that financial institutions are obligated to provide by federal law to shield their customers from losses stemming from credit-card and bank-account fraud.

In the past we’ve found that these protection plans provide questionable value. And some promoters of these services have been slapped by the Federal Trade Commission for misleading sales practices and false claims. We dug into the latest products sold by more than two dozen banks, credit-reporting bureaus, and independent companies. Here’s what we found:

Marketers use fear as a sales tool

The claim. Some ID protectors scare up business with inflated claims about crime. "There were 1.2 million more victims in 2009 than 2008," Chase warned on its website. "And with a growing 11 million victims each year, one of those identities could be yours." The facts. That promo, which ran in November 2011, was based on statistics that were out of date. The latest available data show that in 2010 identity fraud fell 27 percent, to 8.1 million victims. As of last fall, Experian Protect MyID was also still claiming that ID theft is "one of the fastest-growing crimes." More significant, identity fraud is down because financial institutions are doing a better job preventing it. And consumers have become more eagle-eyed about their own accounts, without the need for a paid subscription service.

What you should do. Take the threat seriously, but don’t panic. Even the statistic of 8 million victims overstates the danger. More than 80 percent of what’s been called identity theft involves fraudulent charges on existing accounts, according to the U.S. Department of Justice, but in most cases a cardholder’s liability is limited to $50 for a lost or stolen credit card. For debit cards, liability for an unauthorized transaction is limited to $50 if it’s reported within two business days of the date a cardholder learns of it. After two days, liability can climb to $500 or more, but many banks provide additional voluntary protections.

What’s relatively rare is "new account" and "personal information" ID theft, in which someone uses your name, birth date, and Social Security number to open new credit accounts, tap your health insurance, earn taxable income, or commit crimes in your name. Only 765,000 households were victims of this form of ID theft in 2010, according to the Bureau of Justice statistics, which means the chance of it happening to you is less than 1 percent a year.

A trial offer signs you up for recurring fees

The claim. Fifth Third Bank, which serves 15 states, most in the Midwest, and Affinion, a leading provider of ID-protection products to banks, market Identity Alert by offering 30 days of service for $1. Customers can sign up online and must provide credit-card billing information to pay the small fee.

The facts. Giving up your credit information also allows Affinion to automatically charge your card a monthly membership fee after the trial period, which is disclosed on the sign-up form. Of course, you can cancel at any time, but auto-charging your credit card forces you to do all the work to opt out.

During the last three years consumers have filed more than 2,500 complaints against Affinion with the Better Business Bureau (which gives the company a C- rating), mostly related to advertising, sales, billing, and collections. Affinion is also the target of more than a half-dozen class-action lawsuits, a civil suit by the state of South Carolina, and investigations by many state attorneys general—all related to its marketing and sales practices.

Michael Bush, an Affinion spokesman, says those cases involve "marketing practices that we voluntarily ceased over two years ago." In 2010, one of them cost Affinion $8 million in penalties, costs, and restitution to settle with New York state for sending consumers checks, which, when deposited, automatically enrolled them in a variety of its programs, including Privacy Guard and IDSecure.

What you should do. Before signing up for one of these services, check out the company with the Better Business Bureau. If you see a pattern of complaints about deceptive sales tactics, steer clear.

Credit monitoring can miss a lot

The claim. Identity-protection companies typically claim they provide you with the tools and support you need to guard against the many ways your information might be compromised. For example, Wells Fargo promises to "protect your identity and your credit profile" with its Identity Theft Protection plan, which is delivered by Trilegiant, an Affinion company.

The facts. The core of the Wells Fargo plan and many other protection products is monitoring your credit report. But most of what promoters call ID theft is unlikely to be picked up by credit monitoring, which looks for new accounts that pop up in your credit file. If monitoring does detect suspicious activity, such as someone opening a new credit account in your name, you probably won’t know about it until days or weeks later because of the lag time in reporting.

Robert Dudacek, a Wells Fargo executive in charge of services for insurance and ID protection, agrees that "consumers have essentially zero liability" for existing account fraud. But he says Wells Fargo’s product reduces late-reporting problems by monitoring all three credit bureaus—Equifax, Experian, and TransUnion—because one or two bureaus might not even pick up a new fraudulent account in the first place.

What you should do. Sign up for free alerts from your credit-card issuer and bank that will let you know when, say, a charge above $100 is made to your credit card or if your checking balance falls below a certain amount. Alerts could signal unexpected trouble, and they’re quicker and cheaper than credit monitoring. You can also do your own monitoring by getting free annual credit reports from each bureau, staggering your requests every four months from one bureau to the next. (Go to annualcreditreport.com to do this.)

Million-dollar insurance doesn't cover much>

The claim. American Express ID Protect Premium, provided by Affinion, says its $16 monthly fee includes "up to $1 million in identity theft insurance." The facts. Before you bank on that claim you’d better read the limitations and exclusions that apply under the Chartis master policy No. 7077733, which provides the insurance. But that might be tough to do, since the American Express website doesn’t provide the policy until after you enroll. We found some important limitations in the fine print.

To begin with, ID-theft insurance is secondary to any other coverage that might pay out first, such as homeowners or renter’s insurance, and it mostly covers low-cost incidentals related to or resulting from the crime—notary fees, credit-report costs, loan re-application fees, and a maximum of $1,500 in wages lost "solely" to fix your identity records.

What’s more, the one expense you might really need this coverage for—to pay criminal defense costs if you’re charged with a crime committed by your ID thief—will be paid only "after it has been established by acquittal or dismissal of charges" that you didn’t do it. What do you do for attorney fees in the meantime? Christine El Eris, Affinion’s director of products, says you’ll probably have to pay them up front, but you’ll get the money back if you’re innocent. Leah Gerstner, an American Express spokeswoman, said the threat of being falsely accused of a crime is tiny. "I don’t think that’s something that truly happens a lot," she says.

What you should do. Don’t rely much on insurance to protect you. Instead, take the free, do-it-yourself common-sense precautions described in the next section to help prevent ID theft in the first place.

Free protections as effective as paid

The claim. Most ID-theft products say they offer "comprehensive" protection.

The facts. There are things you can do free that are equally—if not more—effective in reducing fraud losses. Among 439 victims of ID fraud surveyed by Javelin Strategy & Research, a consulting firm in California, the average amount stolen was $4,607. Victims who learned of the crime through an ID-theft protection plan had only $3,363 taken, on average. But those who discovered the crime when their bank or credit-card provider notified them of suspicious activity saw an average of only $2,861 stolen. Those who found the theft through their own monitoring of accounts saw losses of $2,791, on average. And people who uncovered the fraud by simply reviewing their paper statements saw an average of only $2,195 taken.

Of course, because of federal consumer protections and loss-liability limits, actual out-of-pocket fraud costs for victims are significantly lower than the amount stolen. While the average ID-fraud loss was $4,607 for all victims, the out-of pocket cost to consumers averaged only $631, Javelin found. By comparison, the average fraud loss for ID-protection or credit-monitoring customers was $3,363, with out-of-pocket costs averaging only $587.

What you should do. Do it yourself for less. Sign up for online access to your bank and credit accounts and monitor them frequently. Periodically check your credit reports. Put a security freeze on your credit reports, use security software on all your computers and smart phones, and respond aggressively to any hint of trouble.

Web monitoring offers false security

The claim. Intersections, which markets Identity Guard programs, also uses credit monitoring as the core of its products. But it adds "Internet surveillance" to the mix, as a number of other services do. "If we see that your personal information—Social Security number, credit-card or bank-account numbers—is exposed online, we’ll alert you," the company says.

The facts. Once your information is out there, you can’t get it back. "We only give you alerts," says Steve Schwartz, an Intersections executive. "The genie is out of the bottle." As David Kroner, vice president and general manager of card services and insurance at American Express, points out, there’s no form you can fill out to have your data removed from a black-market website. American Express sells Affinion’s product under the ID Protect label.

IdentitySecure’s Social Security Number Fraud Watch is said to use "continuous real-time Web-crawling technology to monitor illicit Web portals," where Social Security numbers are bought and sold by thieves. But the executives from protection companies we spoke with wouldn’t or couldn’t give details about how comprehensive these scans are. And IdentitySecure’s fine print says the company "does not guarantee that it will apprise you of all instances that your SSN or associated records may have been compromised." What you should do. Internet scans could give you a false sense of security if they find nothing and scare you if they find something you can’t undo. Assume the genie is already out of the bottle and put a security freeze on your credit report before trouble strikes. A freeze prevents new creditors from getting access to your file when someone tries to open an account. Without access to the file, creditors are more likely to deny the crook’s credit application.

Consumer Reports has no relationship with any advertisers on Yahoo!

Copyright © 2008-2012 Consumers Union of U.S., Inc. No reproduction in whole or in part without written permission.

More From Consumer Reports

• Electronics buying guide
  
• Coupons in your bank statement?
  
• Money-saving tips