© 2008 Institute of Consumer Financial Education – All Rights Reserved

PREFACE

The purpose of this Report is to provide an objective analysis of participants inthe marketplace of identity theft risk management programs.
Through a comprehensive Survey and extensive research of publicly available
materials, the Institute of Consumer Financial Education (ICFE) has compiled this Reportfor consumers and for organizations that hold personally identifiable confidential
information; they have a duty to protect.
It is important to note that individual consumers have different needs andcapabilities, just as all holders of protected information do not face the same situation
when a data breach occurs.
Accordingly, there is no single “best” provider for all purposes. Some plans are
more comprehensive in their methods than others; some are more or less costly.
Broad-based monitoring of databases that include personally identifiable
information is generally the most effective starting point for preventing identity theft.
Early notification of potential incidents and prompt follow-up are also essential.
Restoration or recovery services may require little input from the consumer – or it
may require the consumer to do practically all the work.
Some plans offer guarantees with varying degrees of ability to fulfill them. The
most valuable of such guarantees are those in which the restoration services are carriedout by specialized third party providers or in-house licensed investigators.
Contrary to a common misperception, identity theft risk management that stops
with monitoring or freezing the credit report cannot prevent nearly half of the reported
incidents of identity theft, including such types as employment fraud, medical and benefit
theft, drivers license issuance, and even criminal activity done in the name of the victim.
There is little regulatory oversight at either State or federal level. Identity Theft
prevention programs that exist only in cyberspace are completely unregulated, and are
only limited by the enactment and enforcement of anti-fraud laws.
The consumer or other user of these services needs to have access to information
to make the best decisions on which is best for the current need.
To this end, ICFE offers this feature-by-feature analysis and comparison of thirtyof the most prominent identity theft risk management programs available in the market
today, in a form that is intended to be most readable and useful to those who are most in
need of such services.
Page 2 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

Summary and Conclusions
Based on an extensive proprietary survey of providers of Identity Theft risk
management services, and additional related research, this Report by ICFE provides abasis for both consumers and entities that hold protected confidential consumer
information to make informed decisions on using such services.
The Body of the Report sets out in detail the Methodology and Implementation of
the Survey and related Study of services available in the marketplace.
This Summary is an abstract of the Matrix of Providers which has greater detail,and is intended to serve as a guide for both consumers and holders of protected
information in selecting the most appropriate and efficacious identity theft risk
management program.
For Consumers:
It is important to understand the risk of becoming a victim of identity theft, so a good
choice can be made. There are generally three types of programs that meet various
needs:• Broad-based monitoring and notification services•

Credit-report monitoring and “freeze” or “fraud alert” programs•

Restoration and Specialty programs (such as medical, employment, or
criminal data)

Broad-based monitoring and notification
Based on the ICFE’s extensive research, the most effective means of preventing
identity theft, and minimizing damage to the victim, is with a broad-based monitoringand notification service. These are the essential elements of such a service:•

Depth and breadth of databases monitored•

Immediate notification to the consumer of any anomalies•

Individualized risk assessment feature•

Means of predicting and stopping the misuse of personally identifiable
information•

Restoration components can complete the safety net of coverage.

Page 3 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

The Respondents in this category are:• IdentityTruth•

IDSafeguards/IDExperts*•

Intersections/IdentityGuard•

ITRisk Managers•

SecureIDSystems/FNB Merchants

Table 1>Credit-report monitoring and “freeze” programs
It is a common misconception that all incidents of identity theft are financial innature, and can be prevented or avoided by taking actions on consumer credit files. In
fact, official statistics indicate that one-third to one-half of all cases reported to theFederal Trade Commission (FTC) are of types that do not appear in credit reports.
Nonetheless, consumer-oriented identity theft risk management programs that couple
credit report-related actions with restoration services can be effective, though notnecessarily fully preventive.

Page 4 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

In order to accomplish their risk management mission, the essential features of these
programs include:•

Continuous monitoring of credit reports, preferably in all three of the major
credit reporting agencies•

Prompt notification to the covered party in the event of any reportable event•

Capability to impose a credit freeze or fraud alert on behalf of the covered
party, upon determination that such an action is appropriate and effective•

Pro-active search of other databases in the event that a covered party
becomes a victim of identity theft•

Restoration/recovery service for identity theft incidents that are outside thepurview of the credit report, such as employment, benefit, medical, drivers
licenses, or criminal activities committed using the identifying information of
the covered party

The Respondents in this category are:• Equifax•

Experian•

IdentityForce•Kroll ∗•LifeLock ∗∗•TransUnion

Table 2>∗

Page 5 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

∗∗

Restoration and Specialty programs
Providers that do not fit neatly into either of the above two categories are assigned to thisspecialty group. They include providers of proprietary programs, private label services,and restoration specialists. Key features of their services include:•

Information and monitoring of specialized databases, such as medical andcriminal•

Restoration services only, based on insurance-premium type pricing scale•

Establishment of a Personal Identity Profile and monitoring of the elements ofsuch individual profiles•

Direct expense reimbursement as an alternative to insurance•

Self-monitoring of selected databases, and proprietary systems for self-help byconsumers

The Respondents in this category are:•Fraud Prevention Institute•

ID Armor•Intelius/ID Watch•

RelyData•

Truston

NOTE: To varying degrees, providers in other categories offer restoration services:
ITRisk Managers, IDSafeguards/IDExperts, and Kroll.

Page 6 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

<Table 3

COMMENTS ON GUARANTEES AND INSURANCE
Guarantees
Several of the providers “guarantee” the effectiveness of their services inpreventing identity theft. Like all guarantees, the value is no greater than the terms andconditions – and especially the limitations. In most cases, the “guarantee” provides forrestoration services, but only if the incident of identity theft is a result of the failure of theunderlying prevention program. The most valuable of such guarantees are those in which
the restoration services are carried out by specialized third party providers or in-houselicensed investigators.
Insurance
Several of the providers include an insurance component in their programs. The
insurance feature typically covers reimbursement for out-of-pocket expenses incurred torestore the integrity of the victim’s identity; most include a “lost work time” provision
with a cap of $500 per week for 4 weeks. There are numerous limitations and conditions
on the coverage. Deductibles range from zero to $250, with a common maximum
coverage amount of $25,000.
Similar coverage is offered by many insurance companies as a rider tohomeowners or renters insurance, at a nominal additional premium or even at no
additional cost.
In general, ICFE believes that the inclusion of an insurance feature in an identity
theft risk management programs is not a sufficient consideration to make it a better
choice than a program without insurance.
ADDITIONAL CONSIDERATIONS FOR CONSUMERS IN MAKING DECISIONS
Page 7 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

•

Early discovery and notification of all types of identity theft-related incidents areparamount; most damage is done between time of the breach and the victim
becoming aware of the problem•

Prompt action is required to minimize damages and to recover the integrity of theelements of the victim’s identity•

Willingness to participate actively in the recovery and restoration process is an
important consideration•

Make informed choices on the elements that are most important to the individual
consumer -- and then act on them.

For Holders of Protected Information:
Typically, the decision to select a provider of identity theft risk management services
occurs when the organization responsible for maintaining the confidentiality of protectedconsumer information has experienced a breach and must take action to prevent or
minimize the damage to potential identity theft victims whose personally identifiable
information has been inadvertently captured by or released to unauthorized parties.
Many of the considerations for selecting such a service are similar to those for theindividual consumer in managing this risk. Of special importance is an assessment of thenature of the risk, based on the type of information that has been compromised and any
available knowledge about the unauthorized party in possession of the information.
In this context, it is critical to realize that the expectation of the person whose
information has been breached is not the determining factor about what choice should be
made. If the breached information would give rise to the creation of false identity
documents or perpetrating employment fraud, for instance, little effect would beaccomplished by concentrating solely on prevention of new account fraud.
Of special interest in this regard is the national Identity Theft Standards Panelinitiative •First, the breached entity, whether it be a business, public or government agency,
non-profit organization, or other holder of protected information, must evaluate thenature of the information that has been breached and vulnerabilities of the individuals
whose information has been compromised.

•

The Identity Theft Prevention and ID Management Standards Panel (IDSP) organized by the American
National Standards Institute (ANSI) and the national Better Business Bureau (BBB) continues to work
toward the identification and adoption of standards for remediation in the event of a breach ofconfidentiality of personally identifiable information protected by law and regulation; ICFE has been an
active participant in this process, and has advocated for the adoption of a standard under which theremediation steps closely reflect the nature and vulnerability of the breached information.

Page 8 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

In general, there are two categories of such information:•

Financial information, such as the specifics that are present in credit reports.

•

Non-Financial information, of the type that does not appear in credit reports,such as employment histories, salary specifics, drivers licenses, criminal records,
medical information such as health histories and drug-related items, and would
typically be information on employees and receivers of benefits.

Once the determination is made as to type of information and the kinds ofvulnerability to which the individuals might be subjected, the decision on the appropriate
risk management and damage control program to employ can be made.
Common provisions of such programs are similar to those offered to consumers; forthis purpose, it is appropriate to incorporate by reference the Tables in the Consumer
Section above.
Two important distinctions should be observed, based on needs of the parties:•

Consumers making a choice among the various risk management
providers start from the assumption that their identities have not been
compromised, and they have an open choice as to which features best fit
their needs.

•

Holders of protected information who have suffered a breach ofconfidentiality need to control various types of potential damage that can
result from the breach; beyond the damage to the affected individuals, thedamage to the enterprise can include loss of public confidence, loss ofcustomer base, damage to employee loyalty and retention, and otheradverse consequences to the organization.

One recent phenomenon that should be put into perspective is the claim that
consumers will be satisfied if their expectations are met in response to a breach of theirprotected information. Unfortunately, the expectations of the consumer are often basedon either unrealistically high standards or unreasonably low standards under which theactual vulnerability of the breached information is simply not taken into account.
It does not help to give the consumer a false sense of security that no harm can befall
him or her from the breach of personal information, in circumstances where theprevention program does not have the required depth or breadth.
The most direct example would be the case in which the compromised information isof the Non-Financial variety mentioned above. Securing the credit files to prevent the
opening of new accounts in the victim’s name does nothing to protect against misuse of
personal information to commit employment fraud, medical and benefit abuse, get adrivers license, or engage in criminal activity to the detriment of the victim.
Page 9 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

ICFE’s experience as well as information collected in the course of the Survey
indicate that the per-person costs of obtaining identity theft risk management coveragefor the benefit of those whose information is compromised are variable and subject tonegotiation. It is notable that there are pricing break-points that can be applied to
calculate upfront costs for a given number of individuals to have access to the program,and lesser per-activation charges payable at the time an individual actually enrolls.

Page 10 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

STUDY AND REPORTBACKGROUND
The ICFE’s 2008 Identity Theft Risk Management Survey and the resulting
Report originated in the educational and research activities of the Institute of Consumer
Financial Education on the subject of Identity Theft.
ICFE has long taken a leadership role in education on credit report issues, andmore recently in the area of identity theft, including active participation in a national
exercise on setting standards in identity theft prevention and restoration.
On the first of these, ICFE has educated and certified thousands of individuals as
Certified Credit Report Reviewers (CCRR™); on the second, ICFE has performed asimilar function for Certified Identity Theft Risk Management Specialists (CITRMS®).
ICFE was an early and deeply involved participant in the national Identity Theft
Prevention and Identity Management Standards Panel (IDSP), a joint initiative of theAmerican National Standards Institute (ANSI) and the national Better Business Bureau(BBB). In this capacity, ICFE concentrated on the area of standards for the Maintenanceof Identity Data. ♦During the course of Phase I of IDSP, existing standards were inventoried, andgaps were identified in the areas of issuance, Transmission, and Maintenance of Identity
Data.
Among the most important gaps, from ICFE’s point of view, were those involving
breaches – it is well known that there are breaches, and also that remediation actions aretaken by the organization that suffers the breach (either voluntarily or pursuant to laws,
which are predominantly defined by a patchwork of State-by-State laws).
More broadly, the statistics collected and reported by the Federal Trade
Commission (FTC) as the national repository indicate that there are several types of
Identity Theft that are most prominent -- see FTC current report on Consumer Fraud and
Identity Theft Complaint Data at
Current risk management and remediation practices have concentrated on credit
report monitoring, but the types of reported IDT events go far beyond what can be doneby credit report monitoring alone.

♦

The Phase I IDSP Report is available online at www.ansi.org

Page 11 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

By early 2008, it was apparent that major gaps in standards included thefollowing:•

Comparison of IDT risk management programs•

Standards for determining the vulnerabilities caused by breaches•

Consistent standards for remediation in the event of a breach

Under the mission of ICFE, consumer education is complementary to education ofholders of protected information. Accordingly, the Survey and Study were designed toprovide a valuable body of information for both consumers and organizations with the
responsibility to maintain the confidentiality of consumer information.
Based on this set of facts and circumstances, in early 2008 ICFE soughtsponsorship for the Survey and Study. We are pleased to express our appreciation to
IdentityTruth, of Waltham, MA, a leader in identity theft risk management, both for thefunding to complete this initiative, and also for the continuing protection of the complete
independence and objectivity of ICFE on which this initiative is founded.

Page 12 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

METHODOLOGY
A fundamentally distinguishing aspect of this initiative is that it is based on
information from the providers of the services, as distinct from surveys based on
consumer satisfaction or perception. In reality, it is difficult if not impossible for
consumers to evaluate the effectiveness of a given risk management or restoration service
in a manner that can be applied directly to others. In a large proportion of reported casesof identity theft, the affected parties may not even know how the identity thief obtainedor actually employed the information that was used.
Where possible, ICFE has sought information directly from the providers ofidentity theft risk management and restoration services. The Survey was designed toelicit information on a broad variety of features and implementation of the various
programs available in the marketplace.
To assure maximum participation, follow-up invitations were sent directly withsecure access instructions. In addition to collecting, analyzing, and evaluating the Survey
information, publicly available information from many sources is also included in theReport. As a practical matter, not all of the providers responded to the Survey, yet theycannot appropriately be excluded from the Report.
Following is a summary of the Survey exercise that was administered through theonline facility of SurveyMonkey.com, which was selected for its flexibility of design,
security features, and analytical capability.
The Summary is divided into 2 parts:•

Questionnaire and Summary of Responses•

Participants.

Page 13 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

QUESTIONNAIRE AND SUMMARY OF RESPONSESThe Questionnaire was designed to pose both specific and general questions andelicit substantive responses. With 135 questions, the information obtained goes beyond a
simple compilation of numbers of specific answers. Many of the respondents included
broad responses with subjective commentary. Beyond the market and program feature
information, ICFE requested and received responses on which to make decisions on its
future educational activities.

Page 14 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

Page 15 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

The last two sections were included for more general research purposes, and will be taken
under consideration by ICFE in fulfilling its broader mission.
PARTICIPANTS
Based on the extensive experience and contacts of ICFE, including
participants, the major providers ofidentity theft risk management and restoration services were identified. ICFE thenconducted an intensive internet search for providers of Identity Theft Related services. A
total of 30 potential participants were invited to play a part.
In general, the participants fall into two categories, plus a “hybrid” of the two:•

Risk Management (“Prevention”)•

Restoration or Remediation•

Providers of Both Risk Management and Restoration/Remediation

Within these Categories, there are three types of services:•

Broad-based, which search many databases in addition to credit reports•

Credit Report Based – which include services of the “Big Three” credit
reporting agencies•

Specialty Providers – such as Medical/Criminal/Profile databases

ICFE made diligent efforts to contact these providers and secure their agreement
to participate in the Survey, with the further understanding that the Survey would be
supplemented with other publicly available information on which to base the Report.
24 of the 30 potential providers did agree to participate.
For a variety of reasons, some known and some not known, only 18 of theproviders did respond to the Survey invitation.
Of these, 15 fully or substantially completed the Survey. The others provided
responses beyond the basic Respondent Information, but insufficient to tally in ameaningful manner.

Page 16 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

While the Survey itself was conducted on a secure server, with password
protection, the Participants were also invited to designate and submit any supplementarymaterial on a CONFIDENTIAL basis; none chose to do so. Nonetheless, many of the
responses were very candid, and ICFE will use the raw information in a judicious
manner.
MATRIX OF PROVIDERS
This narrative portion is a compendium of the information ICFE has collected
through the Survey, internet and other publicly available information, and material
otherwise made available from the providers.
The narratives should be read in conjunction with the three Tables included in theConsumer section of this Report.
Together, they provide an in-depth view including the weighted analysis offeatures and effectiveness of programs, presence or absence of features that are
mentioned by the providers themselves, strengths in specialized areas, and gaps that
became apparent during the analysis of the raw information.
RESPONDENTS
These are the companies who responded to our request to participate and who
substantially completed the comprehensive survey. It is interesting to note that providers
with the most prominent names in the marketplace were very responsive.
Equifax
www.equifax.com
Equifax is one of the Big Three credit reporting agencies. As might be expected theiridentity theft protection program, ID Patrol, is strongly focused on their primary business.
The program allows you to lock and unlock your Equifax credit file in real time. There isalso a component that scans the internet for activity that might be trading your personal
information. This provider has CITRMS certified staff. There is also an insurancecomponent to assist with the expense of recovery in the case of a breach. The service
costs $9.95 to $14.95 per month, depending on selected options. Additionally Equifax isvery active in assisting companies and individuals who are victims of data breaches.
FreeCreditReport.com/Experianwww.freecreditreport.com
An affiliate of another of the “Big Three” credit reporting agencies, this provider
monitors all three credit reporting bureaus daily for fraudulent activity. They provide“dedicated fraud resolution assistance” and a guarantee that provides reimbursement forPage 17 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

certain related expenses. Virginia Surety Company carries the coverage for thisguarantee. Pursuant to federal law they will place a fraud alert only on their own bureau,
Experian, by request only. Additionally their fraud resolution representatives are bonded.
This provider offers customized solutions to the victim of a commercial data breach.
Prices for the consumer product range from $4.95 per month to $29.95.
FNB Merchants/Secure Identity Systems
www.secureidentitysystems.com
This provider appears to be focused on client retention for financial institutions,monitoring and recovery services for families, and plans for employees of businesses, aswell as assistance in the event of a breach of protected information. The services featured
are “Total ID Monitoring,” an anti-phishing service, “Managed Resolution,” and an
insurance component. They also offer educational prevention information via theirwebsite. They have Certified Identity Theft Risk Management Specialists (CITRMS) on
staff. They will place a fraud alert or a credit freeze for the consumer only by request.
As well as credit files they monitor other public access databases on their customer’sbehalf. Pattern changes in credit file activity are considered a reportable event and thecustomer is notified within 24 hours. This provider monitors and will report activity notincluded in credit files. In the event of a breach, a resolution advocate is assigned toassist the consumer through the resolution process. The consumer is expected toparticipate in a significant portion of the resolution process. This provider does extensive
annual background checking of their staff. They also work with holders of protected
information in the event of a breach. Their plan for individuals is priced at $6.95 permonth or for families at $12.95 per month. Pricing for businesses is quoted byapplication.
Fraud Prevention Institutewww.fraudpreventioninstitute.org
This provider specializes in medical fraud prevention. They have Certified Fraud
Examiners on staff and are members of the International Association of Certified Fraud
Examiners. They are a 501 (c) 3 nonprofit. They monitor medical and pharmacy records
for signs of fraud. They also examine third party payor records. This provider uses a
predictive model that examines the use (or misuse) of pharmaceuticals to detect medical
identity theft. They evaluate their results through federal felony conviction rates which attimes approach 100%. The staff undergoes background and fingerprint checking. This
provider works with both consumers and the holders of protected information. This
company also does public seminars to educate the consumer on medical identity theft.
There is normally no charge for the services.

Page 18 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

Intelius/ID Watch
www.intelius.com
This is a multifaceted provider that does background checks, people searches and otherresearch tasks. As part of their protection services they offer identity theft protection
called ID Watch. They create an identity profile for the client and then monitor it to
discover breaches. This service costs between $4.95 per month and $9.95 per monthdepending on the length of the commitment. There is a $25,000 insurance component todeal with the expense of recovery services.
Intersections/ Identity Guard
www.intersections.com
Intersections provides identity theft protection services using the marketing name Identity
Guard. Survey information indicates a much richer solution that includes public record
monitoring, application and address change monitoring and software that protects theclient from internet threats such as keylogging and other spyware. The company alsouses a proprietary activity calculator model to analyze compromised identities in assisting
the recovery process. Notification of an event is within 24 hours of discovery. This
product costs $14.99 per month with the first month free. The company also offers awide array of services that are indirectly involved with identity protection. Businessservices comprise an important part of the Intersections activities in the area of Identity
Theft risk management.
Bearak Reports dba Identity Force
www.identityforce.com“Identity Force provides a complete package of identity protection and credit monitoring
to consumers, enterprise customers and state and federal government agencies.” They
also private label their services. They will place a fraud alert for a covered party byrequest only. This provider guarantees to restore a consumer’s identity to pre event
conditions as long as the consumer meets the requirements needed to accomplish this.
They expect minimal participation by the consumer other than the required forms, etc.
These services are provided by licensed, bonded investigators. Their insurancecomponent is underwritten by AIG. This provider started business doing backgroundscreening for commercial and government clients. There are two identity theft plans:
Basic for $39.95 per year and Complete for $139.95 per year.

Page 19 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

ID Safeguards/ID Experts
www.idexpertscorp.com
This provider’s proprietary product, Fraudstop, uses technology to detect not only credit
issues but public records and utilities that can be vulnerable to identity theft. This
provider maintains a team of recovery experts in the event of a breach, they claim a“100% success rate” for this team. The provider describes the recovery services as “fully
managed”. There is also a reimbursement component of $20,000 underwritten by AIG.
Many of the recovery team hold the CITRMS certification. The Fraudstop product isavailable as a private branded offering. There is no indication that this provider uses a
predictive model of any kind. This provider also offers complete data breachmanagement services. This provider advocates licensing for both companies andindividuals involved in the identity theft protection industry but worries that regulation
might stifle innovation. This provider also offers a very basic risk assessment tool for
consumers. The most popular consumer plan is $139.95 for individuals and $269.95 peryear for families.
Identity Truth
www.identitytruth.com
This provider is unique in that they comprehensively address the potential incidents ofidentity theft that will not appear on the credit report as well as the more common credit
related issues. They use proprietary technology using multiple databases to review theentire identity profile. Their staff holds multiple professional designations. This provider
employs a data warehouse and a predictive analytical engine to produce an effective
system of predictive fraud modeling. The predictive model analyzes the behavior of an
identity thief to compare with the behavior of the consumer to produce an effective
prevention tool. With the “earliest possible notification” ™, the consumer can interact inreal time with the entire process. The remediation benefit in the event of a breach canrange from complete consumer involvement to employment of a case manager to drive
the recovery process. Third-party professional restoration services are provided by
RelyData. Charges for restoration services are based on the extent to which the consumer
decides to be involved. The IdentityTruth service costs $9.95 per month, with substantial
discounts for longer term commitments.
ID Armor
www.idarmor.com
ID Armor “activates, maintains and enforces consumer rights to eliminate exposure to
identity theft for $1.99 per month” payable annually at $23.88. They will place a fraud
alert on covered parties by request only. They do not provide services directly to holders
of protected information. They do not provide risk assessment for their covered parties.
This provider will help their subscriber opt out of junk mail and pre-approved credit
offers. They will provide a CITRMS-certified specialist to help the subscriber enforce
their rights in the event of a breach. The subscriber is expected to have minimal
Page 20 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

involvement in the recovery process. They will offer their services to the victims of adata breach. Education is limited to web content and email communication.
IT Risk Managers Inc.
www.ITRiskmanagers.com/www.myIDsite.com
This provider specializes in “proactive online educational and recovery program that
includes financial reimbursement for out of pocket miscellaneous expenses.”
Management is CITRMS certified. This provider will do enterprise management both
pre and post breach. The reporting is limited to credit related fraud. Licensed, bonded
investigators provide recovery services. The recovery component is outsourced to AIG.
Annual prices for the service range from $12 to $160. Often this provider’s services areoffered as an employee benefit. Educational seminars are available for enterprise clients.
Kroll Fraud Solutions
www.krollfraudsolutions.com
An operating entity of Marsh & McLennan Companies, Inc., this provider offers
integrated pre- and post- identity theft solutions including restoration services. The
products are extensively private labeled. This provider focuses on credit fraud; noncredit discovery and restoration. Conduct pro-active searches of other databases in theevent that a covered party becomes a victim of identity theft. Licensed investigators
provide Restoration services. Services for enterprise breaches are available. There areseveral levels of service available for both consumers and enterprise clients.
LifeLockwww.lifelock.com
The primary business model for this provider is to place credit freezes on the member’s
accounts with each of the three credit reporting bureaus as well as removing the names
from pre-approved credit offer lists and junk mail lists. They offer a $1,000,000 service
guarantee. They offer a service called WalletLock that attempts to cancel and replace all
documents and accounts in a wallet that is lost or stolen. Although the survey response
indicated that they use proprietary software called eRecon-Internet to search for possible
breaches, as of this date, there is no indication that this service has been implemented.
Similarly, it appears that a claim that this provider will offer an identity theft scoredeveloped by an ”objective third party” who specializes in analytics for banks
internationally has not yet been fulfilled. The recovery service expects the consumer will
participate on a moderate level in the process. This provider offers a speakers bureau thatwill send a CITRMS certified speaker to address community groups at the request of themember. The cost for the service is $110 per year per individual and $25 per year foreach child.

Relydata
Page 21 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

www.relydata.com
This provider provides proactive identity theft protection, credit report monitoring,consumer education, and restoration services. All staff has passed the Consumer Data
Industry Association Fair Credit Reporting Act (FCRA) certification examination. The
primary focus of this provider is restoration services. Their restoration services are theoutsourced solution for several of the major providers of identity theft protection. Since
the restoration services are case by case, the pricing is as well.
TransUnion
www.transunion.com
Although TransUnion is also one of the “Big Three” credit reporting agencies, it wasnecessary to supplement Survey responses with additional research. Under the marketingname TrueCredit, TransUnion offers credit monitoring from all three bureaus. They willplace a fraud alert only on their own files. They do not use analytic models in their work.
They will private label their services but do not disclose any particulars. $14.95 permonth covers monitoring of all 3 credit reporting agencies. They offer notification within
24 hours of critical changes.
Trustonwww.mytruston.com
This provider is “dedicated to helping people deal with identity theft without putting
personal information at risk.” The web based MyTruston service uses a proactive
identity theft product that includes free credit reports and fraud alerts. There is acomplete recovery service available as well. The online services have been designed to
be used by partners with a minimum of revision. The services can be unbundled andembedded on a partner site seamlessly. This service is a self guided service so theconsumer monitors their identity theft solution. This service has been referred to as“TurboTax for identity theft”. The recovery service is a “prescriptive workflow” thatguides the victim through the recovery process. A key to this service is they never see
any personal or confidential information. They provide guidance and information. This
service cost can range from free to $10 per month.

Page 22 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

Under the parameters of the study it was determined to invite the significant providers
as well as some other companies who appeared to have a presence in the identity theftprotection discussion. All the companies contacted were offered the opportunity toparticipate and provide direct answers to the Survey Questionnaire. The companies thatare not included in the main portion of the study fall into two categories.
•

There were a number of companies that were invited to participate in the study
who declined to complete the survey document. Information on those companies
uses information from the company websites as well as publicly available
information.

•

There is also group of companies who were considered for the study that did not
respond to attempts to contact them for a variety of reasons. These companies arelisted principally with their web site information.

Invitees who were contacted but did not respond to the survey
CSIdentity
www.csidentity.com
This provider is based in Austin, TX. This provider offers an array of monitoring
services that includes sex offender records, non-credit loans and internet surveillance.
The website does not specify how these monitoring services are rendered nor does it
include any indication of internal security measures to protect client confidentiality.
There is reference to “Cyber Agent” technology but no detail what that includes. The
website does indicate that the restoration services are included. Price: $9.95/month
Debix
www.debix.com
This provider initially agreed to participate, but chose not to complete the survey andonly suggested unspecifed resellers be contacted instead. The company website claims
that Debix is the only provider that can prove they stop identity theft. The methodology
appears to be a proprietary variation on the consumer credit freeze or fraud alert. The
LoudSiren product features immediate contact with the covered party in the event of an
attempt to open a new account. Business solutions are offered but require a form to besubmitted. Debix offers a remediation program called Data Breach. The information
offered on their web site for this product makes extensive reference to a recent survey ofconsumers by Javelin commissioned by Debix. While Debix claims to be the best andonly solution to prevent identity theft, the service does not appear to address any of theidentity theft occurrences that never appear in the credit report. Posted price is $149 per
year.
Page 23 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

Identity Theft 911
www.identitytheft911.com
This provider provides services primarily for companies, though “crisis resolution” isalso offered to individual identity theft victims (through the Identity Theft Resource
Center, a third-party non-profit organization). The approach consists of three areas:
Retainer Solutions provides resolution services. Database SWAT team uses the “Identity
Lock” response team to respond to and repair data breaches. The third area is consulting
services. Consumer education is delivered on a separate site, www.identitytheft911.org.
Pricing is not mentioned on the website but appears to be priced by negotiation.
ID Watchdog
www.idwatchdog.com
The response to the survey by this provider was minimal, though the website details a fullfeatured product that recognizes that there are many instances of identity theft that are notcredit related. This provider operates on an “Identity Profile Review” system, underwhich the consumer’s personal information is collected, and then compared withinformation posted in numerous databases. According to the web site, this monitoring isonly conducted monthly. “If new addresses, phone numbers or names appear in yourpersonal records, we will notify you immediately and one of our identity theft specialists
will work with you investigate these changes.” Pricing: 15 days FREE, $19.95 a monthafter.
NameSafe
www.namesafe.com/
A video that starts automatically when the website comes up indicated that the founder,David Ridings, is an attorney with extensive experience in identity fraud. It appears thefocus of this service is the legal prosecution of identity theft. They will provide legal
representation and remediation in the event that the identity thief can be apprehended.
While advising the consumer of the fact that the law provides that the consumer can place
their own alerts with the credit bureaus at no cost, this service does place continuing
fraud alerts. The services also will provide the member with advisories on new orchanging identity theft scams. The provider also arranges for junk mail reduction. This
provider has a law firm that will assist in the prosecution of an identity thief and help you
restore your identity. The cost is $9.95 per month or $99 per year.
Trusted ID
www.trustedid.com/
This provider offers the consumer a wide variety of services including free credit reports,
scanning of personal and financial information, fraud flags, review of medical identity
theft, reduction of junk mail, protection against spyware and a $1,000,000 warranty.
Page 24 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

There is no indication on the website how these services are performed or where they are
performed. There is no information on the website of the security measures this provider
uses in the delivery of services. It appears that this provider is placing credit freezes onclient credit files. This provider also offers corporate services that appear to be post
breach. There is no indication on the website that these services are preventive in nature.
Pricing is $8.25 per month for an Individual or $15.83 per month for the Family.

Providers that did not respond to repeated inquiries
Several other providers appear to be potentially significant through industry knowledge,
Internet searches, and other research methods. Diligent efforts to contact them were
unsuccessful. For purposes of inclusiveness, they appear below.
Credit Lockwww.creditlock.com
Research indicates that this provider is owned by a company named GammaWealthStrategy & Research, LLC (“GS&R”). This web site provides significant information on
identity theft in the FAQ section. CreditLock carries pass-through links to several of theprincipal providers of identity theft risk management services as well as a proprietary“Credit Lock Down” provided by their affiliate GS&R. Interestingly, “CreditLock”
appears as a trademarked name on the TrustedID web site.
Direct Defenderwww.directdefender.com
This provider is located in Cape Coral, FL. The website will not respond to any
navigation command. It always returns to the home page. Additionally there is aproblem with the site’s security certificate. Several voice messages were left at the phone
number listed on the web site, but there were no return calls.
EZShield
www.ezshield.net
This site presents primarily as a specialized check fraud prevention site. Given thewidespread use of debit cards the utility of this service may be limited. There was no
response to numerous attempts to contact.
GE Moneywww.identitytrack.com/
Although several business names are used by this provider, efforts to make direct contact
were not fruitful. According to the web site, the services are oriented toward credit reportmonitoring and prompt notification to the consumer of certain events, assistance from“Identity Theft Recovery Agents,” and expense reimbursement from Travelers Insurance.
Page 25 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

The Enrollment page of this web site discloses that the provider of the monitoring andnotification services is Intersections, Inc.
IdentityCare by Checks in the Mail
www.identitycare.com
This site offers identity theft recovery service for $9.99 per year, paid in advance, in theevent the consumer becomes a victim of identity theft. The enrollment is web based, andincludes a “Recovery Guide that includes activation forms and instructions.” Theprovider promises a “Dedicated Identity Theft Recovery Advocate” to assist the victim.
There is no other contact information at all on the website.
Identity Theft Prevention Institutewww.stolendata.blogspot.com
This operation seems to be a blog promoting a book by the principals. The most recent
posting is from January 18, 2007. From the header of the blog: “The ID Theft Prevention
Institute is a professional center for the development of policies at the federal, state, local,
and corporate levels that will better protect Americans against identity threats. The
Institute also develops innovative tools for educating employers and employees on safe
handling of sensitive information. Research partially funded by National Science
Foundation and Iowa State University Center for Information Protection. Directors Dr.
Steffen Schmidt and Michael McCoy.” Mr. McCoy is a Certified Identity Theft Risk
Management Specialist (CITRMS), certified by the ICFE.
Myfico.com
www.fairisaac.com
Fair Isaac has a broad variety of credit report monitoring and related services available
from “Free Trial” to $4.95 per month ($49.95 annual), to $8.95 per month ($89.95
annual), plus several add-on options. TransUnion and Equifax are the providers of thecredit reports. The quarterly monitoring service includes resolution assistance andinsurance coverage up to $25,0000 underwritten by St. Paul Travelers. Businesssolutions are also available to address data breach situations; prices are negotiable.
Numerous attempts were made to connect with this organization, to no avail.

Page 26 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

Page 27 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc

ABOUT THE INSTITUTE OF CONSUMER FINANCIAL EDUCATIONThe ICFE www.icfe.info was founded in 1982 by the late Loren Dunton (creator of the“certified financial planner” (CFP) designation) and it is dedicated to helping consumersof all ages to improve their spending, increase their savings accumulation and use credit
more wisely. The ICFE trains and certifies Personal Finance Instructors for its own
curriculum, “The Money Instruction Book.” It also professionally trains Certified Credit
Report Reviewers and Certified Identity Theft Prevention Risk Management Specialists.
The ICFE is an award winning, nonprofit, public education organization that has helped
millions of people through its education programs and resources. It publishes the Do-ItYourself Credit File correction Guide which is now in its 22nd printing. The ICFE has
distributed over one million “Credit/Debit Card Warning Labels” and “Credit/Debit Card
Sleeves” world wide.
The ICFE became an official partner with the Department of Defense/Financial
Readiness Campaign in June of 2004. Since 2005, ICFE has certified over 5,000
individuals as CCRR, CITRMS and Instructor qualified professionals who are employed
by a wide range of organizations including financial institutions; mortgage, real estate,
and financial services firms; corporations; law enforcement, US military and othergovernment agencies. Many others are privacy and security practitioners and consultants.
The Institute of Consumer Financial Education 2008 Identity Theft Risk
Management Survey and Report initiative was headed by Yan Ross, CITRMS®, ICFE’s
Project Manager for the Certified Identity Theft Risk Management Specialist Program.
Special thanks go to Evan Whalley, CITRMS®, of Desert Solutions, LLC, for his
participation in this initiative.

ABOUT THE SPONSOR

Page 28 of 28© 2008 Institute of Consumer Financial Education – All Rights Reserved
AUG 08 IDT Study - REPORT TEXT FINAL.doc