Odds are good you’ve encountered an identity theft protection service in the last year, even if you weren’t looking to sign up for one. ID protection services are served up as remedies in data breach settlements; they’re add-ons for bank accounts and credit cards; they’re even found in anti-virus suites.
Their popularity and reach shouldn’t be a surprise given the massive scale of the problem. The FTC’s Consumer Sentinel Network, which tracks fraud, ID theft, and related issues, received 6.47 million reports in 2024 alone—the highest number yet. The median loss was $497, over 124,000 reports claimed a loss of $10,000 or more.
When it comes to ID theft protection, the details matter. “I will tell you that not all are created equal,” says Tracy (Kitten) Goldberg, director of cybersecurity at Javelin Security & Research. “Some are very valuable, and some are not worth the investment.”
ID Protection Is Insurance
The most important thing to understand about ID protection is that it’s an insurance product.
Most ID protection services also throw in monitoring services, but the core service you’re buying is an insurance policy that protects from losses caused by ID theft.
In this sense, the term “ID protection” is arguably misleading. It implies an active attempt to protect your identity from those who’d want to steal it. In truth, most ID protection services are reactive. They provide compensation for any harm caused by ID theft after it occurs.
That’s important to understand because, as with most insurance products, the devil is in the details. ID protection services often provide headline figures about the total damages covered, but the language surrounding that coverage is critical and includes various sub-benefits.
For example, NordProtect promises up to $1,000,000 in reimbursement of eligible expenses. But expenses for “lost wages and child/elder care for time taken to address the identity theft” are capped at $5,000. That sort of caveat is typical, and I still recommend NordProtect on the whole. But if you thought that $1,000,000 headline figure would compensate you if the stress of the event put you out of work for a few months, you’d be in for a surprise.
Pay Attention to Scams, Extortion, and Bullying
Goldberg says you should pay attention to the types of ID theft that are covered, as coverage is often narrower than you’d assume. “You have to read between the lines a bit,” she says. “If you’re victimized by what is defined as a scam, a social-engineering attack where you’re coerced into giving out information about yourself, you likely don’t have protection.”
Scams aren’t the only type of cybercrime that’s often exempt from ID theft policies. Other common exemptions include cyber extortion (which usually includes ransomware), cyberbullying, and title fraud. I think most people would describe these events as ID theft when speaking casually, but ID theft services may disagree.
Every policy will define a qualifying ID theft event, and those that I reviewed were most focused on financial transactions like unauthorized bank account transfers and fraudulent accounts or loans set up under your name, largely because these are the most widely damaging crimes.
Even here, the details can be tricky. For example, Lifelock’s current base policy documents completely exclude digital currency. If someone cleans out your Bitcoin wallet, or anything else considered digital currency, you’re out of luck—unless you also have Lifelock’s Cyber Crime Coverage, which adds protection against loss of digital currency.
Despite Flaws, ID Protection Is Still Worth It
The many exemptions found in ID protection policies are a hassle. But like other forms of insurance, that doesn’t mean ID protection isn’t worth the effort. Home and renters’ insurance policies also include pages and pages of exemptions, but most people still find the coverage worthwhile.
And unfortunately, ID theft is a common issue even for people who closely guard their personal data. Goldberg points out that even people who are careful today often weren’t as careful in the past. “The digital persona I put out today is different from 15 years ago. I used to share a lot more information about myself and the people I was connected to,” she says.
Read the full article here