A new report from the Government Accountability Office questions the usefulness of services such as identity monitoring, credit monitoring and identity theft insurance, particularly when it comes to safeguarding against tax refund fraud.
The GAO acknowledged that identity theft services offer some benefits but cautioned about limitations. Credit-monitoring services, for example, can help detect when an unauthorized account has been opened in someone's name by alerting users, but such services don't prevent fraud or address fraud occurring on an existing account, including misuse of a stolen credit card number. Consumers also have some low- or no-cost alternatives to credit monitoring, the GAO pointed out, such as asking the major credit bureaus for a free annual credit report or for a credit freeze, which can restrict access to the consumer's credit report.
Identity-monitoring services are supposed to alert consumers to misuse of their personal information by monitoring sources such as public records and illicit websites, but the GAO said their effectiveness in mitigating identity theft is unclear. The services scan these sources for a consumer's personal information, such as names, addresses, and e-mail addresses, along with their credit card, Social Security, driver’s license, passport and medical insurance numbers. The services promise to alert consumers when they detect new or inaccurate information about them or detect their personal information in an inappropriate place, such as a black-market website. However, the GAO could not find any studies or data assessing the effectiveness of identity monitoring. One provider told the GAO that monitoring could be evaluated using information on the number of “hits” their service detects on sources such as black-market websites, but acknowledged the information could be difficult to interpret because many of the hits are not the result of fraud.
Identity restoration services try to remediate the effects of identity theft, but the GAO pointed out that the level of service can vary. Some providers provide more hands-on assistance, interacting with creditors on the consumer's behalf, but others only offer self-help information, which is of more limited value and basically puts the onus on consumers to do the work.
Identity theft insurance covers some expenses related to the process of remediating identity theft, but this type of insurance typically excludes direct financial losses. In addition, the GAO found the number and dollar amount of claims has been low.
The GAO noted that such services also usually don't address some types of threats, such as medical identity or tax refund fraud, along with debit or check card fraud. Some consumer groups argue that identity monitoring can provide a false sense of security to consumers who don't understand the limitations.
In terms of tax refund fraud related to identity theft, the IRS estimated it paid at least $2.2 billion in fraudulent calendar year 2015 refunds, and it prevented at least $12.3 billion more from going to fraudsters. No identity theft service expressly addresses identity theft refund fraud, according to the GAO's review of these services and interviews with providers, consumer groups and federal agencies. Third-party monitoring isn't feasible for tax refund fraud because the IRS generally can't share taxpayer information with outside companies. Thus, it's unlikely there will be a direct-to-consumer product built around preventing identity theft refund fraud, according to a Federal Trade Commission staff member with whom the GAO spoke.
The IRS recommends consumers can protect themselves against identity theft by taking standard commonsense measures to protect their Social Security number and other personally identifiable information (such as not carrying documents with their Social Security number and only providing the number when it's required). In addition, IRS can issue victims of identity theft refund fraud an Identity Protection Personal Identification Number to prevent future fraud.
However, the IRS suffered a data breach with its IP PIN service in 2015, and the Treasury Inspector General for Tax Administration issued a critical report this week about the IRS's response (see IRS ignored recommendation to deactivate hacked IP PIN program).
While no identity theft services try to detect or prevent identity theft refund fraud, one provider told the GAO its service predicts a consumer's risk for becoming victims of tax refund fraud and offers education on the steps they can take to detect or prevent it, such as filing their tax return early. Other providers claim their identity restoration services can provide guidance to consumers who become victims of identity theft refund fraud.
The GAO recommended Congress should consider allowing government agencies to determine the appropriate coverage level for identity theft insurance that's offered after data breaches. The Office of Management and Budget should also analyze the effectiveness of identity theft services compared to alternatives, the report suggested, and it should explore options to address duplication in how federal agencies provide such services.