LifeLock, the company that created a goldmine by purportedly getting more than million customers to pay $10 a month primarily to file fraud alerts that they could have otherwise filed themselves for free, has agreed to pay $11 million to the Federal Trade Commission and $1 million to 35 state attorneys general to settle charges that the company used false claims to promote its identity-theft protection services.
LifeLock has been widely promoted in television and radio ads and has been personally endorsed by talk radio giant Rush Limbaugh and other broadcast personalities.
Despite the agreement, LifeLock and the FTC seem at odds over its significance. The FTC calls it “one of the largest FTC-state coordinated settlements on record.” And FTC Chairman Jon Leibowitz pulled no punches in denouncing LifeLock’s practices.
“While LifeLock promised consumers complete protection against all types of identity theft, in truth, the protection it actually provided left enough holes that you could drive a truck through it,” said Leibowitz in a press release.
But Mike Prusinski, a LifeLock spokesman, sought to clarify their take-home message. “The agreement examines old practices and old products, and establishes federal and state regulatory guidance for our industry going forward,” he told Consumer Reports in an e-mail response.
In fact, the misleading practices are still fresh. LifeLock was forced to stop selling its fraud alert service only seven months ago in August, 2009, according to Prusinski. That was after Experian, the credit reporting agency, won a court ruling to stop LifeLock from making mass filings on behalf of its customers.
Ever clever, LifeLock turned the Experian lemon into lemonade. It’s now touting “a new and innovative identity protection system--one which does not involve setting credit fraud alerts—that provides even better and broader protection,” said Prusinski.
“Many parts of the FTC action no longer reflect our current practices, largely because our services have evolved over time to benefit the consumer. In addition, Chairman Leibowitz’s characterization of our advertising claims is significantly at odds with our understanding of our customers’ actual expectations—as several of our own customer surveys show,” said Prusinski.
A key deception alleged by the FTC boiled down to LifeLock’s claim that it provided a “proven solution that prevents your identity from being stolen before it happens.” According to the FTC, the service also involved retrieving customers’ already legally free annual credit reports, submitting customers’ otherwise legally free requests to opt-out of pre-screened credit card offers, and offering a $1 million guarantee if LifeLock’s system failed to prevent ID theft.
“In fact, the ID theft prevention service did not prevent identity theft and did not
provide many of the protections claimed by Defendants,” the FTC complaint says.
Todd Davis, LifeLock’s founder and CEO admitted as much to us, when Consumer Reports Money Adviser first broke this story two years ago
: “We know this isn’t 100-percent bulletproof. You can still be a victim,” said Davis.
The FTC complaint charged that the fraud alerts that LifeLock placed on customers’ credit files didn’t protect against identity theft involving the misuse of existing accounts. New account fraud, the type of identity theft for which fraud alerts are most effective, comprised only 17 percent of identity theft incidents, according to an FTC survey released in 2007.
The FTC also confirmed what we found two years ago: Fraud alerts are no guarantee against ID theft, since some businesses don’t always obey them and subsequently allow crooks to open accounts in other people’s names anyway.
And the FTC alleged that LifeLock’s fraud alerts provided no protection against the misuse of existing credit accounts—the most common type of identity theft—or against medical identity theft or employment-related identity theft, in which thieves use personal information to get medical care or apply for jobs.
The inherent flaws in fraud alerts prompted another company, Debix, to create a more effective type of alert worth considering
. As we’ve seen before in other settlements involving the FTC
, the defendants admitted no wrongdoing or liability in what they were alleged to have done, while being barred from making any deceptive claims. They also were required to take more stringent measures to safeguard customer information.
“This agreement effectively prevents LifeLock from misrepresenting that its services offer absolute prevention against identity theft because there is unfortunately no
foolproof way to avoid ID theft,” says Illinois Attorney General Lisa Madigan.
Look for our upcoming report on living with identity theft, including an assessment of the various products and services that claim to provide protection, in Consumer Reports Money Adviser newsletter
A spokesperson for Limbaugh’s syndicator, Premiere Radio Networks, declined to comment about his promotion of LifeLock’s claims. But Prusinski says LifeLock still advertises on the Limbaugh program and El Rushbo, as he sometimes refers to himself, still enthusiastically endorses LifeLock. —Jeff Blyskal