Is Equifax's Free ID Protection Service Good Enough?
How to know if selecting this security option is the best move for you
Equifax is offering the 145.5 million people affected by its security breach—as well as anyone else—a free, one-year subscription to TrustedID Premier, the credit bureau’s identity protection service.
Equifax’s ex-CEO, Richard Smith, recently described TrustedID Premier as "a robust package of remedial protections.”
But is it really? We took a look at TrustedID and many of its competitors to help you decide your best course.
But before you sign up for any of these services, be aware that most of them aren't very secure themselves. Access to your identity protection account is commonly protected by a username and password, which can easily be hacked.
Levels of Protection
TrustedID Premier is one of many products that comprise the $3.8 billion identity theft protection business.
Companies that sell these services, including well-known players like LifeLock, generally offer less-expensive basic plans whose main function is to monitor your credit reports (usually for about $10 a month), as well as costlier deluxe plans that keep an eye on other kinds of accounts and transactions (monthly fees range from $20 to $30).
What You Get
TrustedID Premier provides five basic services:
- One Equifax credit report, but none from Experian, Innovis, or TransUnion.
- Three-bureau credit monitoring and alerts about changes in your credit report. Credit monitoring is the core of all identity protection services, and three-bureau is better than one-bureau. But alerts warn you about a lot of noise in your credit file. "Theres no prioritization of what's dangerous and what isn't. You get a lot of alerts about routine things," says Aviva Litan, a security analyst at Gartner, Inc., a technology research firm.
- Monitoring of the so-called dark web black market for misuse of your Social Security number.
- The ability to lock access to your Equifax credit report by lenders considering an ID thief's application for new credit in your name. You can also easily unlock your report when you need to apply for credit yourself. However, Equifax will also be offering this locking feature free for life to all consumers by the end of January. Although a lock is similar to a security freeze, a freeze is better.
- A $1 million identity theft insurance policy that is an industry standard.
TrustedID doesn't offer other features that even some other basic ID theft protection plans make standard, according to the Javelin assessment.
For example, most plans that Javelin evaluated monitor public records for misuse of your identity that may turn up in criminal court filings. Most also monitor the dark web, but not just for SSNs; they also hunt for the trading of your credit and debit card numbers, checking and other bank account numbers, email addresses, and health insurance policy numbers.
TrustedID also does not offer any level of help resolving the problems that can crop up if you become a victim of ID theft. Almost all of the other protection services that Javelin evaluated, including some basic ones, promise to help victims report fraud and close bogus accounts. And most offer subscribers the ability to grant limited power of attorney, which is needed to resolve more complicated crimes, such as income tax fraud and medical identity fraud.
You're more likely to find other useful features with the more deluxe services. LifeLock's top-of-the-line Ultimate Plus plan, costing $30 per month, monitors big national banks, smaller local banks, and credit unions coast-to-coast for fraudulent new checking or savings accounts in your name, which criminals could use for money laundering. Ultimate Plus also monitors investment and retirement accounts for fraudulent cash withdrawals and balance transfers.
Most protection services lack an increasingly important security measure, two-factor authentication. Often, that's a security code necessary to access the account that's transmitted to your smartphone. Facial recognition, fingerprint, or other types of biometric authentication are other factors that can be used to verify your identity and block account access to thieves.
"Major banking services are using two-factor authentication. It's surprising that identity protection services don't do the same thing," says Justin Brookman, director of consumer privacy and technology at Consumers Union, the policy and mobilization division of Consumer Reports.
The danger? "Weak authentication can make an identity protection service a one-stop shop for fraudsters because through it they can access information on much of a subscriber’s financial life," says Al Pascual, research director and head of fraud and security at Javelin.
Regarding security measures, three of Javelin's top five services stand out. EZShield employs biometrics and also requires additional authentication when someone tries to log in on an unfamiliar laptop, phone, or other device. IDWatchdog uses device recognition, and IdentityForce uses onetime passwords and geolocation.
What You Should Do
One key goal of free credit monitoring and other ID protection services is to give victims “peace of mind.” And free is always tempting. But insufficient low-end protection could give you a false sense of security.
If you’re inclined to pay for more comprehensive protection, you should certainly shop around to get the most robust suite of services at the lowest possible price. But remember, these services—free or paid—can and should never be a substitute for your own continuing personal efforts to prevent and detect identity theft.
That's why “We recommend a credit freeze instead of identity protection because it’s cheaper and better,” says Anna Laitin, director of financial policy at Consumers Union. Next, take other steps to lock down your bank, mutual fund, and other accounts and guard against tax return fraud, medical ID theft, and other threats, which a security freeze can't thwart.