The Best Identity Theft Protection Services
Help get your life back
Total identity protection is wishful thinking: no service can actually prevent your identity from being stolen. Where the best identity theft protection services add real value is in the breadth of their monitoring (aka both credit and personal info) and if they use power of attorney to help restore your identity for you. We signed up for a bunch of accounts and read a lot of fine print to see which ones deliver.
It will cost you extra, but ID Watchdog is the only service that will help you recover your identity even if the theft occurred before you were a member.
For its members, IdentityForce offers services that match ID Watchdog: robust monitoring and a team that works to get your identity back — not just give advice.
LifeLock was acquired by Symantec in 2016, and we expect Symantec’s data security chops could influence our opinion of LifeLock — we won’t know for sure until the merger closes at the end of April 2017.
We updated pricing for ID Watchdog’s Platinum plan: Costs went from $18 to $19.95 per month for individuals.
If you’ve recently had your identity stolen, identity theft protections services can help you clean up the mess. That’s the good news. If you want to proactively protect your identity, let’s level set.
Identity theft protection services don’t actually protect anything. They’re a combination of monitoring and recovery, not an invisible shield around your social security number. So while they can’t decrease your chances of becoming a victim, they’ll alert you when something goes awry and help you clean up the mess. But the best don’t stop there: Instead of sending you a checklist and a hotline number, a few services assume power of attorney to act on your behalf, saving you the many hours and major hassle of calling federal agencies, filing affidavits, and in rare cases, hiring lawyers.
Our top pick, ID Watchdog, is the only service we found that offers this recovery service even if your identity was stolen before you became a member. If you’re positive you’re not yet a victim of identity theft, we recommend IdentityForce, which offers near-identical monitoring and restoration services for its members in a more modern-looking package.
Our Picks for the Best Identity Theft Protection Services
It may not come in the shiniest package, but in terms of both service and price, ID Watchdog stands out. Its star attribute is something no other company offered: rehabilitation for pre-existing theft (all the other finalists require you to discover the theft during your membership). This means you can find a bogus item on one of your credit reports, or discover a warrant out for your arrest, before enrolling in ID Watchdog, and it will still work on your behalf to remove it using power of attorney.
Keep an eye on your kids. Unfortunately, a child’s Social Security number can be even more valuable to thieves than an adult’s, since it’s typically squeaky clean. When paired with a fake DOB, it can be the key to an identity heist that often goes undiscovered, sometimes for years, because children generally have no reason to check their credit.
Termed “ID Rehab for Previously-Existing Conditions,” the service carries fees in addition to the membership cost (it’s $80 per financial record error, $180 per civil court record error, and $280 per criminal court record error), but depending on the reach of your damage, it’s possible it could wind up being a bargain. If you discover the theft during your enrollment, restoration is covered under your standard membership agreement (the same as with our other three finalists).
ID Watchdog’s Platinum plan is also cheaper than any of the other premium services we reviewed ($19.95/month), and it has some of the most cost-effective family options.
ID Watchdog earned “Best Overall” thanks to its one-of-a-kind rehab service for pre-existing events. But if you’re confident you’re not yet a victim, you might prefer IdentityForce’s UltraSecure+Credit, which combines every other feature in a slicker, more attractive site.
IdentityForce will also monitor your bank account transactions and alert you to any withdrawals over a certain amount, something ID Watchdog doesn’t do. But, it means sharing your account numbers and isn’t necessary if your bank offers the same service (which most do).
The scope of IdentityForce’s monitoring and restoration promise matched those of our other top finalists (with the exception of ID Watchdog), and at $20/month (or $200 annually — which essentially gives you 2 free months), its UltraSecure+Credit package is one of the less expensive premium offerings on the market. Child protection is also affordable at $3/month per kid (or $28/year), although there’s no discount for parents: Each must purchase an adult membership.
Other Identity Theft Protection Services to Consider
LifeLock met our identity-monitoring and restoration criteria, provided confidence-inspiring phone service, and offered child protection for $5.99/month (or $65.99/year) on top of adult membership (around $26.99/month; $296.90/year depending on various promotions for the Ultimate Plus plan). But LifeLock has also been sued twice now by the Federal Trade Commission, the last time in 2015 when it was ordered to pay $100 million back to former customers for failing to secure their personal data up to advertised standards. It’s too bad, because besides having the most comprehensive alerts (including the option for a phone call that will put you in touch with a live rep who can explain the alert’s significance), LifeLock was also the only one that walked us through the process of “opting out” from having our personal info visible on people search sites like Spokeo, a proactive way to limit online exposure.
In November of 2016, LifeLock was acquired by Symantec, the maker of Norton and arguably the most renowned name in cyber security. Greg Clark, Symantec’s CEO, indicated in the press release that the two forces would be combined, but we won’t know what that means for customers until the deal officially closes (sometime in the first quarter of 2017). It’s logical to expect LifeLock will learn a thing or two about protecting its customers data from Symantec, but for now, we aren’t ready to endorse the company.
At the end of the day though, we’re just not ready to fully endorse a company with such recent and significant security concerns.
Initially a dark horse candidate, Credit Sesame surprised us by making our final four, although we still have reservations about some aspects of its service. We loved its promise of “full-service white glove identity restoration” and were particularly impressed by one of its features: stolen/lost wallet protection in which the company cancels and replaces all your credit cards and IDs for you. Lots of companies advertise “lost wallet protection” (including all four of our finalists), but all they actually do is keep your card numbers online to make it easier for you to cancel them yourself. By contrast, our Credit Sesame rep assured us that they would take over locating the phone numbers, waiting on hold with banks and agencies, and requesting replacements, patching us in only for the times when we need to speak for ourselves. We didn’t have occasion to experience its full-service restoration ourselves, but that part at least sounds pretty “white glove.”
Your data is out there. People use web-crawlers to get publicly available data, like estimates of wealth, credit status, religion, and spouse’s names. Though collecting these specs isn’t illegal, it makes it easier for thieves to piece together info they need to impersonate you. (Spokeo was fined in 2012 for marketing its profiles in violation of the Fair Credit Reporting Act, but still exists and has several copycats.)
Still, Credit Sesame isn’t without warts. First of all, the “Platinum Protection” price swung wildly over the course of this review, starting at nearly $40/month and landing at around $16/month at the time of publish. And unless you’re paying, it’s absurdly difficult to locate contact info for the company (the Contact Us” page has no phone number or email, just a link to a message board and FAQs, which doesn’t cut it at all). Everything is also awkwardly packaged within the company’s free, ad-packed site, which is crowded with credit card offers. We get that this is how it’s able to offer free credit monitoring (through ad revenue from lenders), but when the login screen for your service is dominated by a giant credit card ad, something doesn’t feel right. All in all, it seems like a good service unnecessarily weighed down by the limitations of its free version. And, it doesn’t offer child protection.
How We Found the Best Identity Theft Protection Services
We started by putting together a list of the 18 companies that claim to help consumers maintain ownership of their personally identifying info (we didn’t include ones that only serve businesses). Our initial look at their offerings confirmed that this is an industry littered with unspecific language. Is “credit monitoring” single- or tri-bureau? Does “restoration” mean filing documents and hiring experts, or merely giving advice? We had to dig for details.
We cut any company that doesn’t monitor changes to your credit reports at all three credit bureaus.
Your credit reports are what lenders use to decide whether or not to offer you a loan, so they’re crucial to your financial reputation. They’re also the way many people first learn they’ve been scammed: A bogus account, debt collection, or legal judgment shows up on one of them. The three major credit-reporting agencies — Experian, Equifax, and TransUnion — all compile reports, but use different methods for data collection and have different results. That’s why it’s important to check all three: What shows up on one might not show up on the others.
While everyone has the right to one free report a year from each of the bureaus, early fraud detection requires much more frequent checking. Many companies offer continuous, “real time” monitoring of all three credit bureaus, so we made that our first benchmark for contenders.
EverSafe, IDFreeze, IDShield (LegalShield), Intelius, ProtectMyID (Experian), Zander ID Protection
We also eliminated companies that don’t monitor the use of your personally identifying information online.
Credit monitoring can help you discover red flags sooner than you would otherwise, but certain types of fraud simply won’t appear on your credit reports. If someone has access to things like your Social Security number, driver’s license number, bank details, and/or medical insurance ID, they can steal from your existing accounts “as you” without anyone reporting it to the bureaus. You won’t find out until the next time you check your balances.
And, even though most credit issuers notify the bureaus when a new account is opened in your name, there are important exceptions. A payday loan, for example, requires no credit check and will only appear on your credit reports after it goes to collection — at which point it will have sky-high interest and take substantial paperwork to get removed.
Risks like these stem from your personally identifying information (PII) being out there, and while there’s no way to close Pandora’s box once it’s leaked, there are limited ways to track its exposure. This is where so-called “identity monitoring” comes in. By scanning online databases for your personal info (including consumer records at retailers, utilities, and banks, as well as public records like court documents), identity theft protection services can alert you when you’re potentially at risk. Just like credit monitoring, this won’t actually prevent fraud, but it can prompt you to add security to your accounts (such as changing passwords or enabling two-step verification), and hopefully reduce your response time if a theft occurs.
Know your network. LifeLock’s ID Network (acquired when the company purchased ID Analytics, Inc. in 2012) is the only actual name we learned, but we don’t know which banks, wireless carriers, online lenders, and other entities are included — only that it supposedly scans “a trillion data points a day.”
However, identity monitoring is only as good as the network it employs, and we found it practically impossible to get specific info on any contender about their network’s reach. So in the absence of this, we simply required companies to monitor each of the following categories (which are themselves less than specific): court records, payday loan sites, and “black market” sites where thieves buy and sell identifying details. Our thinking was that even if these scans aren’t comprehensive, they’re better than nothing. We also required scans of the National Change of Address Database, since filing an address change is something thieves often do to keep their victims in the dark, preventing them from getting bills and notices on fraudulent accounts.
Control Your ID (RelyData), Equifax Premier Plan, Identity Fraud, myFICO, Privacy Guard (Affinion), TrustedID IDEssentials
Then we graded them on how they alert you to suspicious activity and potential fraud.
If credit or identity monitoring reveals something fishy, how does the company let you know? We eliminated any that don’t offer both email and text notifications, along with 24/7 availability by phone. If an alert’s significance isn’t immediately clear, we want to know we can get someone on the line quickly to explain it, and initiate recovery steps if necessary.
Most importantly, we made sure that if your identity is stolen, they’ll do as much legwork as they legally can to reclaim it.
In 2014, the Federal Trade Commission estimated the average identity theft victim spent more than 200 hours across 18 months resolving their issues with credit-reporting agencies. Lots of companies offer “recovery assistance” in the wake of a stolen-identity event, but their concrete services vary widely. (Some, like Identity Guard, offer advice over the phone, while others, such as IdentitySecure, give you online tools.)
To be worth paying for, a service should actually do the work of contacting creditors, employers, and law enforcement agencies on your behalf, involving you only when necessary. This requires a temporary power of attorney authorization from you, and there are still important things it can’t cover, including dealings with the IRS or Social Security Administration (which were necessary to resolve 39 percent of identity theft cases in 2014). Without granting power of attorney though, you’ll definitely have to place every phone call, write every letter, and send every email yourself, and that can eat up hours.
“The true cost of identity theft isn’t in paying back what’s been stolen, but in clearing your name.”
Additionally, $1 million insurance policies have also become ubiquitous (15 of our 18 initial contenders offer them), but just as with restoration services, it’s important to read the fine print. Every policy we reviewed has much lower coverages for specific, common recovery expenses, such as document filings, travel, and lost-wage reimbursement if you have to take time off work. The million-dollar limit applies only to legal fees, and those are typically minor since most identity theft incidents are settled without attorneys.
Even though there are significant limits to both power of attorney and insurance, they represent the best restoration service a company can offer, so we required contenders to include both.
Identity Guard, IdentitySecure (Affinion)
Lastly, we compared the experiences of actually using our top services.
Only four companies met our battery of exceptions, but we couldn’t pick a favorite without using the services ourselves. We enrolled in, paid for, and entrusted our most sensitive information to ID Watchdog, IdentityForce, Credit Sesame, and LifeLock, and compared what we got in return. Was it easy to understand and manage alerts? Could we get questions answered quickly, and in plain English? How confident did the entire package make us feel that we were protected? And what surprised us about each service, pleasantly or not?
Our testing could only go so far since (thankfully) we didn’t uncover any major red flags, so we couldn’t compare actual restoration services. But we did comb through each company’s fine print “explanation of benefits” and confirmed with their reps what we could expect if things went sideways.
Did You Know?
Even the best services can’t help you with certain types of identity theft.
Commercial services can monitor your credit reports, public records, and certain other websites, but privacy laws bar them from accessing your medical benefit statements, as well as any tax info or Social Security benefits paid in your name. It’s up to you to keep track of these things by requesting your records from the agencies themselves.
Tax-related identity theft, in which a thief claims your tax refund before you do, is also disturbingly prevalent. In 2015, it accounted for nearly 49 percent of all reported identity thefts. And because government offices also do not recognize power of attorney to resolve disputes, the most an outside company can do for you in that situation is give you the right forms to fill out.
“HIPAA Privacy Rules prevent health care providers and insurers from disclosing your personal health info to third parties, so it’s your responsibility to confirm the correctness of your medical records.”
Medical identity theft is potentially quite scary, because in addition to exhausting your insurance benefits, it can pose real threats to your health. When someone else obtains care in your name, your files may be updated to reflect their diagnosis and treatments. This means that if you show up at the hospital in a life-threatening emergency, you might be given the wrong drug or otherwise not get the care you need.
Any time you receive medical treatment, you should get an Explanation of Benefits (EOB) statement or Medicare Summary. Read these line by line and pay special attention to the services provided, the name of the healthcare provider, the date of the service, and your personal information. The slightest error — like a misspelled name or incorrect procedure date — could be a warning sign of medical identity theft. Report errors like these to your health plan; you’ll find the customer service number on the statement.
Getting a bill for a medical service that didn’t happen is another blatant sign of identity theft. Also keep an eye out for odd notices regarding your health plan’s benefit limit or debt collections that your don’t recognize. The bottom line is if anything on your medical statements or notices doesn’t make sense, investigate it.
Here’s how to correct mistakes on your medical records:
- Request copies of your medical records. Reach out to every health care provider you’ve used — not just your doctor, but any labs, hospitals, or physical therapy centers, too — and request copies of your records. Some providers might ask you to pay for them, but no provider can legally withhold your information. If a provider refuses to oblige you within 30 days of a written request, you should file a “Privacy or Security of Health Information” complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights.
- Account for Disclosures. When you request copies of your medical records, also ask providers for a copy of the “accounting of disclosures” for you files, which is a list of when, where, why, and to whom your information has ever been released. Legally, you can request one copy every 12 months from all your medical providers.
- Request Corrections. If you find any errors, write a letter to the health care provider describing them and send it by certified mail (or fax) — this cannot be done online. Ask for a return receipt before shipping it off, and keep copies of everything. Also be sure to explicitly document the disputed items; circling errors on a copy of the record in question works.
No company can safeguard your personal data 100 percent.
Hackers and security teams are continually trying to outsmart each other, and the ever-growing list of data breaches is evidence that the good guys don’t always win. Even though each of our finalists employs state-of-the-industry security, the decision of whether to entrust your personal information to them is still one to weigh against the potential benefits of their post-theft recovery services.
There are free and low-cost alternatives to paying for protection.
Given that the “protection” offered by companies is really just monitoring and restitution, it’s important to know what you can do for yourself on these fronts. (In fact, this is the main reason Consumer Reports advises to skip paying for identity protection altogether.)
The Fair Credit Reporting Act entitles all Americans to one free report per year from each of the three bureaus (request them at AnnualCreditReport.com). Sites like Credit Karma and Credit Sesame (the free version) also provide no-cost, single-bureau monitoring, with alerts when something big changes.
New account fraud is on the rise. New account fraud — a scheme where identity thieves apply for new cards with your information — grew over 100 percent from 2014 to 2015 and now accounts for 20 percent of all fraud losses in the US.
If you get suspicious (or just paranoid), you can also place a free 90-day fraud alert on your credit file, which directs potential lenders to verify your identity directly with you before opening any new accounts in your name. Or if you think your identity’s already been compromised, you can go a step further and lock your credit reports via a credit freeze. This prevents creditors from even seeing your files. It costs $5–10 to place a freeze, depending on your state (and the same again to “unfreeze” if you want to apply for new credit) but it will prevent 99% of unauthorized new accounts. “A credit freeze is the most effective method out there for stopping new account fraud,” says Minniti.
If a thief does end up causing havoc with your info, IdentityTheft.gov is the federal government’s free restitution website, with step-by-step instructions on what to do for specifics types of ID theft. While it’s enough for an industrious victim to resolve most incidents, it doesn’t pay for expenses and it’s 100 percent DIY.
That $1 million insurance is worth less than you think.
Million-dollar insurance policies are practically a standard feature of identity theft protection companies these days (like we said, 15 of our initial 18 contenders include one), but it’s important to know what they do and don’t cover.
For starters, the policies that come with these services only kick in after all other coverage has been exhausted, so if you have an identity theft clause or rider in your homeowners or renters policy, you should make sure you’re not paying for additional coverage you won’t be able to use.
Know too that most of that hefty $1 million limit applies only to legal costs, which you’re unlikely to have except in a particularly complex case. Things like wage reimbursement, travel expenses, and child care have much lower limits under the policy: typically $1,000–$2,000 per week, for a maximum of four to six weeks. Stolen-fund reimbursement is also rarely used because of consumer protections in the Fair Credit Billing Act (FCBA) and the Electronic Fund Transfer Act (EFTA). You’re never on the hook for more than $50 from an unauthorized credit card use, and as long as you report a theft within 60 days, your maximum liability for check or debit card fraud is $500.
The Bottom Line
While no service can prevent you from becoming a victim of identity theft, the best will be on high alert for threats through continuous monitoring of your credit reports and your personal information online. If your identity is stolen, you want a service that can take control of restitution to the extent of their legal power of attorney — but even that has no advantage in cases involving government benefits.
Best Identity Theft Protection Services: Summed Up
Utilize free account services at your bank or credit issuer. Most banks offer free transaction-monitoring tools that will notify you whenever an account withdrawal exceeds a limit set by you. An increasing number of credit card companies also bundle credit scores and monitoring with their standard service. Both are free ways for you to stay up-to-date on important financial data.
Opt-out of prescreened offers. Unsolicited mail from credit card and insurance companies is more than just annoying; it can actually be dangerous if it falls into the wrong hands, since it contains your full name, address, and the promise of approval for credit. OptOutPrescreen.com lets you remove your info from the list that credit bureaus give to banks and insurance companies, so they’ll stop sending you preapproved offers. You can always check your credit and available offers yourself at a free credit-monitoring site anyway.
Make a habit of reviewing your medical and insurance statements. Because of health information privacy laws, identity theft protection services can’t monitor your medical statements. Read bills, collection notices, and any other medical statements to ensure the information is accurate. Something as simple as an incorrect date for a procedure could be a sign of medical identity theft.
More Identity Theft Protection Service Reviews
We’ve been looking into identity theft protection services for a few years now, and you can check out some of our other reviews. They aren’t consistent with our latest round of research (yet!) so be on the lookout for updates in the coming weeks: