IMGCAP(1)]
GE Money, which issues and manages credit cards for hundreds of retailers, disclosed in mid-January that a computer backup tape containing identity data on 650,000 cardholders had disappeared. Though it is unclear whether the tape was stolen or just misplaced, the news chipped away a little more confidence of many American consumers already edgy about the security of their personal and financial information.
Preventing identity theft, particularly involving credit cards and online transactions, has become a growing consumer obsession. And that obsession, which some experts say is based on fears more imagined than real, has spurred the growth of dozens of services and products that claim to protect consumers from fraudulent misuse of their personal data
"Identity-fraud protection services represent a burgeoning market that will continue to grow at double-digit rates with high profit margins for at least the next several years," asserts Rachel Kim, a Javelin Strategy & Research analyst, in "Identity Fraud Protection Services," a recent Javelin report. "Due to the confusion and fear of consumers, identity-fraud protection services are a marketer's dream: three out of four consumers believe that identity fraud is on the rise, despite steady declines in the crime over the past three years."
The frequency of fraudulent activity stemming from identity theft might be diminishing, according to the Javelin report. However, actual incidents of personal data theft are so widespread that some experts maintain that virtually every American has had his or her personal data stolen at some time.
"It's the fastest-growing crime in America," Todd Davis, CEO of LifeLock Inc., a Tempe, Ariz.-based provider of ID-fraud prevention services, says of identity theft. "You're 25 times more likely to have your ID stolen than your car broken into."
Davis promotes LifeLock in print and in television ads in which he broadcasts his Social Security number to demonstrate how confident he is that his company can protect his identity. LifeLock offers fraud alerts and other services to its customers for a $10 monthly fee.
Most identity theft, however, generally does not result in actual acts of fraud. That only occurs when thieves use personal and financial data to tap into individuals' funds or credit lines or to open new accounts under victims' names.
Still, the perception persists that consumers would be prudent to do all they can to protect themselves against identity fraud, and companies are rolling out programs to
offer a range of such services.
Findings from surveys, such as one taken last year by technology-services company UniSys Corp., suggest that up to 70% of Americans worry they will fall victim to online identity theft.
Among the companies offering credit-protection services to consumers are the three major credit bureaus: Equifax, Experian and TransUnion. All three offer credit monitoring and alerts when they notice a change in a consumer's credit activity.
The firms also offer forms of ID-theft insurance. Experian, whose insurance covers up to $10,000 for certain ID-theft expenses, charges $4.95 monthly. TransUnion provides insurance that covers up to $25,000 for a monthly fee of $11.95. And Equifax, which insures for up to $20,000, charges a range of fees, from $6.95 to $12.95 per month, depending on frequency of credit reports, the amount of insurance, and the number of bureaus covered in the reports.
The most common services offered include monitoring consumers' credit records for suspicious activity and alerting consumers when someone tries to apply for credit in their names.
Two services growing in popularity involve freezing consumers' credit files so no new credit may be added in their names and scrutinizing public records or databases for compromised identity information thieves could use fraudulently.
Data-shredding services are another tool. Shred-Tech of Cambridge, Ontario, for instance, provides mobile shredding trucks that visit businesses or communities that need to shred documents. Another company, the Sanford division of Atlanta-based Newell Rubbermaid Co., even has produced a uni-ball brand pen with special ink that embeds itself into paper fibers, making it difficult for crooks to wash the ink off of checks to rewrite them for different amounts and to different recipients.
And a London-based company, MobiClear Ltd., markets a service in several countries that calls subscribers on their cell phones each time card-not-present purchases are initiated over the Internet in their names. Customers must provide the MobiClear personal representative with a special PIN to verify they are legitimate cardholders and approve purchases before MobiClear allows transactions to proceed.
All Sizzle, No Steak?
Whether such initiatives fulfill their often-lofty promises of protection, however, is open to debate.
"Consumers need to be aware of products that are all sizzle and no steak," warns Jeremiah Miller, manager of New York-based Kroll's Fraud Solutions, a fraud investigation, credit monitoring and restoration center. "Nothing is foolproof. These are tools that can help you identify some of the things that can cause identity theft."
Security experts maintain that no perfect tool exists to prevent ID theft; the best that can be hoped for is to make it as difficult as possible for thieves to steal and use sensitive consumer data.
"There's no lock that can't be picked," says LifeLock's Davis. "The question is, how hard do you make it? And if it fails, what do you do?"
One of the most prevalent criticisms of for-profit protective services is that consumers can take many of the actions on their own, without having to fork over the $10 to $12 a month that many of the companies typically charge for their programs. The Federal Trade Commission lists on its Web site ways in which consumers may protect their identities and payment accounts.
Self-Protection
"The best protection is self-protection," says Joel Hewer, a partner in the Washington office of the New York law firm Kelley Drye & Warren LLP. "In some cases people are overanxious because they don't know how to protect themselves."
An increase in alerts by LifeLock of risks of fraud against its customers led Experian to file suit against LifeLock in February. Experian's complaint, filed in the U.S. District Court for the Central District of California, alleges that LifeLock's policy of alerting credit bureaus of risks to thousands of customer accounts every 90 days is outside the intent of the U.S. Fair Credit Reporting Act.
"Credit grantors will lose the ability to distinguish between fraud alerts added by consumers who legitimately believe that identity theft is imminent and those added by LifeLock," Experian alleges in the lawsuit.
LifeLock CEO Todd Davis calls the suit "frivolous" and says his company's services are exactly what the Fair Credit Reporting Act intends.
ID-protection services charge a fee for many services consumers often can obtain for free, such as annual checks of their three credit-bureau files and credit freezes offered by banks, merchants and others following data compromises. Some states have enacted laws mandating free credit freezes (although consumers usually must pay fees to have the credit freeze lifted).
Of course, card issuers and networks offer zero-liability protections for cardholders if criminals misuse their cards.
So why should consumers pay anyone to do what they can do for themselves? Consumers pay, at least in part, to avoid the indirect cost, time and energy they would expend recovering their creditworthiness if they were victimized by ID fraud, according to Kroll's Miller and others.
Typically, according to Javelin's Kim, it takes a consumer about 25 hours to resolve an identity-fraud case and restore one's credit. But in complex fraud situations, far more time must be spent to bring cases to full resolution.
Lost Time
Many services offer insurance to cover lost time from work and such costs as lawyer fees, the expenses in getting one's credit restored, fees for investigators and accountants, and compensation for money actually stolen. LifeLock, for instance, says it will pay up to $1 million to help consumers fully restore their identities and credit. It covers legal fees, makes good on any money actually lost, and pays for an investigator.
"The single-biggest loss in identity theft isn't credit, it's in lost productivity" while trying to restore one's credit worthiness, says Bryan Ansley, CEO of Secure Identity Systems. "The hassle factor of proving it wasn't really you takes a lot of time. That's a real financial impact."
The Brentwood, Tenn.-based company offers protective services, including fraud alerts, data mining (the monitoring of public records and Internet sites for possible compromised data) and insurance to restore credit.
While card issuers offer zero-liability protections to consumers for fraudulent card transactions, Javelin's Kim tells Cards&Payments no such protection exists to help consumers if someone fraudulently opens new accounts, such as bank or home equity lines of credit, in their names. That is why new-account fraud can be so costly to consumers.
Kim says new-account fraud is the crime of choice today among savvy identity thieves, and its financial repercussions are far greater on consumers than fraud involving existing credit cards.
Javelin calculates the mean fraud amount involving an existing credit account at $3,979 in consumer cost. That compares with $7,261 for an incident of new-account fraud.
"Our aim is to give you an early warning before a problem occurs," says Steven Domenikos, CEO of IdentityTruth of Waltham, Mass. More than 220 million personal records have been lost or stolen online, he says, demonstrating that prevention of theft is impossible.
IdentityTruth claims to monitor billions of data points, at post offices (to check changes of address), utilities and with the U.S. Social Security Administration, for instance, to ferret out any type of activity that might hint at illegal use of subscribers' identities. Individual consumers would have a difficult time monitoring so many diverse databases.
Clients pay $9.99 per month or $99 for a year's service.
"Credit card companies are good at detecting fraudulent activity," Domenikos says. "But [identity theft] goes way beyond credit."
Domenikos says 15% of IdentityTruth's registered customers have received fraud alerts related to such "unrecognized" activities as cell-phone and credit card applications or transactions.
More To Come
Rich Baich, a principal with Deloitte & Touche USA's enterprise risk services, says identity theft will continue to plague consumers for years to come. That is because it has considerable appeal to criminals, which include organized crime organizations and terrorist elements, according to some industry experts.
"If you go to a bank and rob [it for] $30 million, you're going to have a task force tracking you down," says Baich. "But if you steal 3,000 credit cards, what sort of focus will you generate? Obviously, not as much. So the criminals see credit cards as a better value."
Choosing from the various types of protective services and deciding whether to pay for them is confusing for consumers, says Javelin's Kim. Often, she adds, decisions are based on the wrong reasons.
"Perception, or misperception, has a huge part in all of this," Kim says. "Some people don't realize what they've signed up for. Right now, it's really the advertising that is driving the adoption of these services. But over time, actual performance, value and user experience will be equally as important."
When that happens, competition will heighten among the firms offering protection against potential identity fraud. But with so many Americans worried that their data and their identities might be stolen, there should be plenty of business for those companies offering the strongest protection and the best restoration services. CP
