First Target dropped the ball by failing to protect 40 million customers whose payment card data was stolen by hackers and another 70 million shoppers whose names, addresses, phone numbers, and e-mail addresses were stolen at the height of the 2013 holiday shopping season. Now the retailing giant has fumbled a second time by providing second-rate credit-monitoring services, a new Consumer Reports analysis has found.
In mid-January, Target said it was offering "additional peace of mind" by giving affected customers free ProtectMyID credit monitoring services from Experian, one of the three big U.S. credit bureaus. The move looked like a reasonable response—with caveats—that seemed to live up to Target's famous value proposition: Expect more, pay less.
But on signing up, I found that the offer actually delivers less and pushes customers to pay up to $74 more.
The service can give consumers a false sense of security, and Consumer Reports can recommend this deal in its present form only as being better than nothing, and only for consumers who understand its significant shortcomings. Here's why.
One-bureau credit monitoring
The type of credit monitoring offered by Target watches only one credit report—Experian's—and not the credit files maintained by Equifax and TransUnion. "The information on each of your three bureau credit reports can be very different," Experian said. Consequently, by not monitoring two of three bureaus, the service could miss fraudulent activity.
Credit monitoring is not much use for most of what is now called “identity theft,” which involves old-fashioned credit card theft, because monitoring watches your credit report, not unauthorized charges to your existing accounts. But it can be useful against new-account fraud, in which a crook uses your Social Security number and other personal information to open credit accounts in your name. Monitoring tracks changes in your credit report that could indicate fraud, such as the opening of a new account or inquiries by a lender deciding whether to extend credit to your doppelganger.
Unfortunately, credit monitoring is a primitive defense against ID theft that can scare you with lots of alerts for day-to-day nonfraudulent changes in your credit report—only 1 in 20 alerts is actual illicit activity—and that can ultimately train you to ignore the alerts.
That's why industry best practices recommend three-bureau monitoring when Social Security numbers have been stolen, because those are the golden key to new credit.
But although Target has assured customers that “there is no indication that Social Security numbers have been taken," the company also knows that the personal information stolen from Target has opened the door to subsequent theft of Social Security numbers. “We are aware of some scams concerning phishing in the form of e-mails, text, fake websites and phone calls designed to steal personal information from our guests in the wake of the recent data breach,” reads the frequently asked questions posted on the company’s website. One Target FAQ involves breach victims receiving a call, text, or e-mail “from someone who said they were with Target asking for my social security number.”
Given that the threat of Social Security number theft is real and heightened for Target customers, we believe that what could be one of the largest security breaches so far warrants three-bureau monitoring.
I asked Target and Experian why they believe one-bureau monitoring is good enough. Experian left the question to Target, whose spokeswoman claimed not to have details about Target's decision-making process and reiterated ProtectMyIDs basic benefits.
Experian sells ProtectMyID to corporations in data-breach crisis, partly by telling them that free credit monitoring makes victims significantly less likely to sue, and gives companies the choice of paying for one- or three-bureau credit monitoring. Target bought and offered the less-expensive one-bureau monitoring.
The giveaway also gives away only one Experian credit report, available online for only one month. It does not provide any Equifax or TransUnion credit reports. To see your credit report again free under this plan, you must wait until after you discover you've become a victim of identity fraud, when someone actually uses your identity to make unauthorized charges to or withdrawals from your accounts or to commit some other theft or crime.
All these lemons for Target customers make lemonade for Experian. As soon as I signed up and got to "My Protection Center," where Experian claimed I was getting "comprehensive identity protection," an Experian ad informed me otherwise and pitched me to buy my "total credit picture. Why wait? View all three of your credit reports and scores now" for $14.95. One breach remediation industry expert who spoke off the record says Experian calls the shots on subjecting Target breach victims to incessant advertising because once the Target "guests" sign up for Experian's credit monitoring service, they become Experian's customers.
Some of those Experian ads exploit consumers who are ignorant of their rights, because consumer protection laws allow ID theft victims to place a free 90-day fraud alert on their credit report and get their credit reports from all three credit bureaus absolutely free. The Experian PLUS score, meanwhile, is a bogus "educational" score that Experian fine print reveals "is not the score used by lenders."