Data Breaches: Range of Consumer Risks Highlights Limitations of Identity Theft Services
Released: 2019-03-27T00:00:00

Letter

Background

Harm from Exposure of Personal Information

Individuals’ sensitive personal information can be lost, stolen, or given away. Once exposed, individuals’ information can be misused to commit identity theft, fraud, or inflict other types of harm. Identity theft occurs when individuals’ information is used without authorization in an attempt to commit fraud or other crimes. In 2016, according to the Bureau of Justice Statistics, an estimated 26 million people—10 percent of U.S. residents aged 16 or older—reported that they had been victims of identity theft in the previous year. One potential source of identity theft is a data breach at an organization that maintains large amounts of sensitive personal information. Recent data breaches include the 2018 breach of Marriott International’s Starwood guest registration database, which may have exposed information of millions of individuals, and the 2017 data breach at Equifax, Inc., a nationwide consumer reporting agency, which exposed identifying information of at least 145.5 million people. The types of harm that can result from exposure of sensitive personal information include the following:

Financial fraud from identity theft, which can include new-account fraud, in which thieves use identifying data, such as Social Security and driver’s license numbers, to open new financial accounts without that person’s knowledge; and, existing-account fraud, which is more common and entails the use or takeover of existing accounts, such as credit or debit card accounts, to make unauthorized charges or withdraw money.

Tax refund fraud, which occurs when a Social Security number or other personally identifiable information is used to file a fraudulent tax return seeking a refund.

Government benefits fraud, which occurs when thieves use stolen personal information to fraudulently obtain government benefits. For example, the Social Security Administration has reported that personal information of beneficiaries has been used to fraudulently redirect the beneficiary’s direct deposit benefits.

Medical identity theft, which occurs when someone uses an individual’s name or personal identifying information to obtain medical services or prescription drugs fraudulently, including submitting fraudulent insurance claims.

Synthetic identity theft, which involves the creation of a fictitious identity, typically by using a combination of real data and fabricated information. The federal government has identified synthetic identity theft as an emerging trend.

Child identity theft, which occurs when a child’s Social Security number or other identifying information is stolen and used to commit fraudulent activity.

Other types of fraud that occur when personal information is used; for example, to set up mobile phone or utility accounts, or to engage in activities such as applying for employment or renting a home.

The harms caused by exposure of personal information or identity theft can extend beyond tangible financial loss, including the following:

Lost time. Victims of identity theft or fraud may spend significant amounts of time working to restore their identities. In 2016, according to the Bureau of Justice Statistics survey of identity victims, most victims resolved issues in 1 day or less but about 1 percent of victims spent 6 months or more resolving their identity theft issues.

Emotional distress and reputational harm. Exposed information also can cause emotional distress, a loss of privacy, or reputational injury. In 2016, according to the Bureau of Justice Statistics, about 10 percent of those who experienced identity theft reported suffering severe emotional distress.

Harm from state-based actors. State-sponsored espionage can cause harm to individuals when nations use cyber tools as part of information-gathering, espionage, or other nefarious activities.

Consumers’ Options to Address Risks or Harm

Options available to consumers to help prevent or mitigate identity theft include actions they can take on their own (generally for free) or services they can purchase.

Actions individual consumers can take themselves include the following:

Placing a credit freeze. A credit or security freeze restricts potential creditors from accessing a credit report until the consumer asks the agency to remove or temporarily lift the freeze.

Placing a fraud alert. A fraud alert on a credit report requires businesses to verify a consumer’s identity before they issue credit.

Monitoring accounts and other information.

Reviewing free annual credit reports. Individuals can request one copy of their credit report every 12 months (available for free at AnnualCreditReport.com).from each of the three nationwide consumer reporting agencies.

Reviewing financial statements and other accounts.

Individuals can review bank and other financial statements regularly for suspicious activity and make use of automatic transaction alerts and other free features that financial institutions offer to detect potential fraud. Individuals also can regularly review mobile phone or utility accounts for unusual activity.

Reviewing health insurance benefits explanations and medical information. Individuals can review explanation-of- benefits statements from their health insurer to detect fraudulent insurance claims or monitor their files at their healthcare providers to detect unauthorized use of medical services.

Consumers also can obtain various free or fee-based identity theft services, which are commercial products that generally offer tools intended to help consumers detect identity theft and restore their identity if it has been compromised. The private research firm IBISWorld estimated that the U.S. market for identity theft services was about $3 billion annually in 2015–2017. The services may be marketed directly to individuals for a monthly or annual fee. In addition, private- and public- sector entities that have experienced data breaches sometimes purchase these services and offer them to affected individuals at no cost.

Identity theft services most often include credit monitoring, which tracks an individual’s credit reports and sends alerts about potentially suspicious activity; identity monitoring, which aims to monitor other sources such as public records and illicit websites (sometimes referred to as the “dark web”); identity restoration, which provides a range of services to recover from identity theft; and identity theft insurance, which reimburses individuals for certain costs related to the process of restoring identities.

Other actions consumers can take to protect their identity include adoption of certain data security practices and early filing of tax returns. Data security practices can help protect sensitive information. For example, individuals can change or avoid sharing or re-using passwords, and make use of strong passwords and authentication options on online accounts; properly safeguard or shred sensitive paper documents; and limit access to their sensitive information on social media. Filing a tax return early reduces the risk of tax refund fraud, and some victims of tax refund fraud may be eligible for an Identity Protection Personal Identification Number (PIN)—issued by the Internal Revenue Service IRS)—to prevent future fraud. To protect their Social Security benefits, individuals can set up an online account at the Social Security Administration to monitor their benefits accounts.

Limited Information Is Available on Effectiveness of Options after Data Breaches, but Credit Freezes Can Prevent New-Account Fraud

We did not identify any studies that analyzed whether consumers who sign up for or purchase identity theft services encounter fewer instances of identity theft or detect instances of financial or other fraud more—or less—rapidly than consumers who take steps on their own. Views of experts varied, but most said identity theft services have limitations and would not address all data breach risks. Most experts also said that a credit freeze, which consumers place on their own for free, is a useful way to prevent one type of financial fraud—the illegal opening of new credit accounts in consumers’ names. Based on our review and discussions with experts, consumers can consider four factors when deciding on options to address risks after a data breach: the extent to which an option might prevent fraud; the cost of an option; its convenience; and the type of information that was exposed and may be at risk.

No Independent Research Assesses Effectiveness of Consumer Options to Address Risks after Data Breaches

Information that can help consumers assess their options for mitigating and addressing the risks of identity theft and other harm from data breaches is limited. Specifically, we did not identify any studies that analyzed whether consumers who sign up for free or purchase identity theft services encounter fewer instances of identity theft or detect instances of financial or other fraud more—or less—rapidly than consumers who take steps on their own for free—such as monitoring their credit reports or placing a credit freeze. For consumers who experienced identity theft, we did not find any studies that compared the effectiveness of free options to help consumers recover from identity theft with commercial identity restoration services. In addition to searching databases of scholarly publications and other sources, a range of academic, consumer, government, and industry experts we interviewed told us that they were unaware of any specific independent studies on the effectiveness of consumer options.

We interviewed representatives of seven companies that provide identity theft services about how they assess the effectiveness of their services and found that what they measure does not directly address how effective these services would be in mitigating the risks of identity theft compared with options consumers can take on their own. For example, two company representatives said that their services focus on detection of fraudulent activity or assistance after identity theft has occurred, rather than on prevention of identity theft or other harms. The representatives of each of the providers said that their companies generally measure how customers use their products and services; customer satisfaction (for example, through surveys or other feedback); and whether the products work as intended (for example, whether alerts of fraudulent activity are successfully delivered to customers or customers can successfully access the company’s website when they need to). Companies that offer identity restoration services also measure the rate at which they complete the process of recovering stolen identities. While it is not possible to prevent identity fraud, four representatives said that early detection of fraud is important as it allows consumers to address potential fraud more quickly.

FTC, a primary source for assistance to consumers on issues related to data breaches and identity theft, has advised consumers that the effectiveness of services that offer identity monitoring depends on factors such as the kinds of databases the service provider monitors, how well the databases collect information, and how often the service provider checks each database. For example, FTC suggests that consumers ask if service providers check databases that show payday loan applications or changes in addresses for misuse of their information as part of identity monitoring. In reviewing consumer education and promotional materials on the websites of five identity theft service companies we contacted that offer identity monitoring, we found that three providers included information about which types of databases they monitor; the other two did not.

Government and commercial entities—such as federal agencies and retail stores—that decide to purchase identity theft services to offer to affected individuals after a breach of their data do not necessarily base their decision on how effective these services are. Rather, according to industry and some government representatives we interviewed, some base their decisions on federal or state legal requirements to offer such services and the expectations of affected customers or employees for some action on the breached entities’ part. Representatives of retail and banking associations we interviewed indicated that it has become the industry standard to offer 1 year of credit or identity monitoring services in the wake of a data breach. One industry representative said that in some cases the decision is not based on the effectiveness of the services. States such as California require companies to offer some type of identity theft service after a data breach. Moreover, Connecticut requires health insurers and certain health care-related companies to offer identity theft services following an actual or suspected data breach. In 2017, we reported that companies do not assess the effectiveness of an identity theft provider’s services when selecting a vendor to provide such services. Rather, they consider other selection factors, including price, reputation, capacity to respond quickly to large-scale breaches, and ability to provide comprehensive post-breach services, such as complying with statutory notification requirements. But companies that purchase identity theft services may be in a position to obtain more detailed information from potential providers than is publicly available to consumers.

Views of Experts Varied, but Most Said Identity Theft Services Have Limitations and Would Not Address All Data Breach Risks

In the absence of independent evidence of the effectiveness of identity theft mitigation options, we interviewed representatives and reviewed consumer education materials, working papers, and articles from academic, consumer, industry, and government entities. No one solution can protect against the full range of risks to individuals whose personal information was exposed in a data breach, based on our review of documentation and the views of academic, consumer, government, and industry experts. We obtained perspectives on the value of options available to consumers. The following summarizes key observations: Identity theft services. Representatives of 9 of the 10 consumer groups we interviewed generally viewed credit or identity monitoring (or both) to be of limited value. However, one consumer group representative noted that identity monitoring might be useful in circumstances in which Social Security numbers were compromised. In addition, a few consumer group representatives indicated that consumers could consider signing up for such services if they are offered for free. If identity theft services are not free, FTC and CFPB consumer education materials recommend that consumers consider the benefits and limitations of such services and compare them to free or low-cost options before signing up. A few consumer groups and one academic highlighted that consumers may not fully understand the limitations of signing up for identity theft services. A few consumer group representatives and one industry and state government representative cautioned that free services may be offered for only 1 or 2 years; exposed information can be used for identity theft or other harms over a much longer period. For example, in 2017, we reported that nation-state actors that steal consumer data as part of their espionage activities can wait much longer than a private identity thief to use compromised information (if at all), according to one identity theft service provider. In addition, CFPB consumer information and a few consumer group representatives noted that consumers should be aware that some services may try to charge consumers after the free period ends.

Some consumer group and one industry representatives also said that the value of one feature of identity monitoring—dark web monitoring—is unclear. One representative said that there is nothing new that consumers can do once they learn their information was found on an illicit website. Rather, they must continue to monitor their accounts as they already should have been doing. In addition, one consumer group representative indicated that these services may provide consumers with a false sense of security.

Experts we interviewed for our 2017 report said that identity restoration in particular could be helpful to consumers. FTC staff and one consumer group representative we interviewed said that one-on-one assistance can be helpful. Identity restoration typically is included with other identity theft services rather than offered as a stand-alone service. However, the level of service provided in identity restoration can vary substantially—some providers offer individualized hands-on assistance, while others largely provide self-help information that is of more limited value. In our 2017 report, we also found that another feature of identity theft services, identity theft insurance, may provide minimal benefits for consumers. More details about identity theft insurance appear later in this report.

Options to prevent fraud or harm unrelated to credit accounts. Consumers have limited options to mitigate risks of other harms from data breaches, such as medical identity theft and identity theft tax refund fraud. Commercial identity theft services, credit freezes, and fraud alerts do not directly address these risks. Some consumer, government, and industry representatives cited self-monitoring as a way for consumers to be on the alert for these other types of fraud.

Consistent with our 2017 report, identity theft service providers we interviewed generally indicated that their products and services do not directly monitor for these types of fraud. However, two noted that they would assist with any identity restoration involving medical identity theft, tax refund fraud, or government benefits fraud (such as fraudulently redirecting Social Security benefits). Identity theft services also may address these types of fraud indirectly—for example, detecting a fraudulent change of address can prevent sensitive health insurance information from being redirected to the fraudster. A few consumer groups said that consumers may not understand which risks commercial identity theft services address. Additionally, we reported in 2017 that identity theft services do not address non-financial harms, such as emotional distress, embarrassment, and harm to one’s reputation. For example, a House Committee report on the OPM data breaches noted that the information stolen from background investigations included some of the most intimate and potentially embarrassing aspects of a person’s life, such as mental health history, misuse of alcohol or drugs, or problems with gambling. Identity theft services also may be of limited value in cases of nation-state espionage. For example, in 2017, we reported that when the source of the data breach appears to be a nation state (as opposed to a private party), the risk of the information being sold for monetary purposes is likely to be lower, according to an FTC representative.

Importance of data security. In the view of some experts, entities such as the federal government and private companies that hold consumer data have a responsibility to protect those data. A few experts said that the burden should not be on consumers to protect data they do not control. Except in certain circumstances, companies are generally not required to be transparent about the consumer data they hold or how they collect, maintain, use, and secure these data. Identity theft service providers may contract with third parties such as consumer reporting agencies or with third-party identity monitoring providers, such as dark web monitoring services. Moreover, one consumer group representative noted that identity monitoring services require consumers to provide additional personal information to enroll—which also could be compromised if the service provider’s information were breached.

Finally, consumer group and government researchers we interviewed suggested other options that entities can (or already) use to address risks of harm. For example, one government researcher noted that financial institutions have started to use multifactor authentication and other technologies that can help institutions verify a consumer’s identity and thus help prevent fraud. Multifactor authentication involves first logging into an online account using the traditional username and password, and then the institution sending a verification code to a mobile phone or e-mail address that the consumer must enter as part of the log-in process. In addition, one researcher noted that some institutions have started to use facial recognition technology, or to ask an account holder to provide answers to questions such as the size of the account holder’s last deposit. Other biometric technologies such as fingerprint recognition on mobile phones, or one-time passcodes that are synced with financial institutions’ websites, also can help, according to one researcher and one consumer group representative. Other strategies can focus on reducing the riskiness of breaches by making information less useful for purposes of committing identity theft. For example, one researcher noted that organizations could encrypt data or use tokens so static account numbers could not be used on their own. There is no single solution to address all risks of harm, based on our review of documentation and the views of academic, consumer, government, and industry experts.

Consumers Can Use Free Credit Freezes and Fraud Alerts to Effectively Prevent New-Account Fraud

A credit freeze is the only consumer option that can prevent one type of identity theft-related fraud, and recent federal legislation made credit freezes free and easier to place or lift. This option is effective because it restricts potential creditors from accessing a consumer’s credit report to open a new account until the consumer asks the nationwide consumer reporting agency to remove or temporarily lift the freeze. In contrast, identity theft services and self-monitoring detect or remediate identity theft after it has occurred, but do not prevent the fraud from occurring in the first place. We interviewed representatives, or reviewed the consumer education or informational materials, of consumer, industry, and government entities and found that almost all of them included credit freezes on credit reports as a useful consumer option to protect against identity theft.

More specifically, the Economic Growth, Regulatory Relief, and Consumer Protection Act, which took effect on September 21, 2018, required the three nationwide consumer reporting agencies (Equifax, Experian, and TransUnion) to make placing and lifting freezes free and specifies that the agencies must place a freeze within 1 business day, and lift it within 1 hour, of receiving a telephone or electronic request (see fig. 1). Consumers must contact each of the three agencies individually and request the freeze. Consumers obtain a PIN from each company, which enables them to lift or remove a freeze at a later date. Before the 2018 act, consumers typically had to pay $5-$10 per agency to place a credit freeze. Some experts had noted cost and inconvenience as some of the limitations to a credit freeze. The new law addresses these concerns to some degree by making credit freezes free and requiring these consumer reporting agencies to lift freezes expeditiously on request.

While the new law removed some barriers to placing credit freezes, others still exist and the freezes have some limitations. For example, consumers still have to lift a freeze before applying for a loan or new credit account and need to place or remove a freeze at each consumer reporting agency separately, which could cause delays for consumers actively shopping for a home, car, or other purchase requiring the extension of credit. Two consumer groups said that there is confusion about how the law would affect minor children. (Under the new law, credit freezes only can be placed on behalf of children under age 16, but not minors ages 16 and 17—who must place freezes themselves).

Moreover, as the new law only applies to the three nationwide consumer reporting agencies, credit freezes do not protect against new-account fraud resulting from the use of credit reports from other consumer reporting agencies. For example, one consumer group recommended that consumers place a fourth freeze with the National Consumer Telecom and Utilities Exchange—a consumer reporting agency that maintains credit reports that telecommunications or utilities companies may use to check the creditworthiness of consumers interested in opening phone or utility accounts. The law also permits insurance companies and employers to continue to access credit reports even after they are frozen, among other exceptions.

One general limitation of credit freezes is that they do not protect against new-account fraud in cases in which credit reports are not used to verify a consumer’s creditworthiness. Furthermore, credit freezes do not protect against existing-account fraud, such as fraudulent credit card charges, or certain other types of fraud, such as identity theft tax refund fraud or synthetic identity fraud using elements of individuals’ identity information.

While experts with whom we spoke across industry, government, and consumer groups generally believed credit freezes to be an effective tool in preventing new-account fraud, some consumer and industry experts indicated that fraud alerts also can be a good alternative for consumers. Unlike a credit freeze, a fraud alert still allows companies to access an individual’s credit report for the purpose of opening a loan or credit account. Fraud alerts notify companies requesting the reports that the individual may have been a victim of identity theft. The alerts require companies to verify consumers’ identities before they issue credit to a consumer. Fraud alerts therefore can make it harder for an identity thief to open accounts in a consumer’s name. Moreover, fraud alerts are easier to place than credit freezes, as consumers only need to contact one of the three nationwide consumer reporting agencies to place a fraud alert (that agency is then obligated to contact the other two on the individual’s behalf). The Economic Growth, Regulatory Relief, and Consumer Protection Act extended the period of an initial fraud alert from 90 days to 1 year.

However, fraud alerts do not restrict access to consumers’ credit reports the way freezes do. Therefore, some consumer group and industry representatives noted that consumers should be aware that a fraud alert may not offer as strong a protection as a credit freeze does. We did not find any data or analysis on the effectiveness of fraud alerts compared to credit freezes or monitoring options. One consumer group told us that it recommends that after a data breach consumers first place a fraud alert, because it requires contacting only one of the three nationwide consumer reporting agencies, and then follow up by placing a credit freeze at the three agencies.

The three nationwide consumer reporting agencies also offer a product called a credit lock that is functionally similar to a credit freeze in that it restricts access to an individual’s credit report. Credit locks do not require consumers to use a PIN and consumers can turn access to credit reports on or off through an application on their mobile phone. However, credit locks are not subject to the same federal requirements regarding the placement and removal of freezes and therefore do not offer the same degree of protection to consumers. Instead, credit locks are private products subject to the consumer reporting agencies’ terms and conditions, which could change. A credit lock is in place only as long as the individual subscribes to an agency’s service, but a credit freeze remains in place until the consumer chooses to remove it. Finally, consumers may be charged a fee to place a credit lock, whereas credit freezes can now be placed for free.

Factors Consumers Can Consider When Assessing Options after Data Breaches

Based on our interviews and review of consumer education materials and our 2017 report, we identified four factors that consumers can consider in deciding which options are best for them in responding to a breach of their personal information:

Prevention. Consumers can consider the extent to which an option might prevent fraud. For example, because credit freezes block all access to an individual’s credit report, by definition they are effective in preventing new-account fraud where credit reports are used as part of the account-opening process. Identity theft services do not prevent fraud, but detect suspicious activity or help restore identities after identity theft.

Cost. Consumers can consider the cost of a service. For instance, consumers can consider whether to pay for commercial identity theft services if they believe the value of the service outweighs the effort of monitoring their accounts on their own. In addition, they may consider that credit freezes now are available for free.

Convenience. Consumers may consider the convenience of a service. For example, while consumers can monitor their own credit reports and accounts, some might prefer not to or may be limited in their ability to do so. In addition, technologies offered through financial institutions that automatically alert customers to any transactions involving their accounts can be a convenient, no-cost way for consumers to monitor their accounts.

Type of information at risk. Finally, several experts from consumer and industry organizations indicated that the type of option that might be beneficial would depend on the type of information at risk. For example, one consumer group representative noted that if a credit card number were stolen, an identity monitoring service that monitored the dark web for Social Security numbers might not be needed. Furthermore, consumers should consider that credit monitoring will be of limited effectiveness in alerting them to misuse of an existing credit account—which is more common than fraud related to setting up new accounts. For more information on consumers’ options, see appendix II.

Federal Agencies Provide Assistance to Consumers Affected by Data Breaches and Identity Theft

Among federal agencies, FTC serves as a primary source for free assistance (including online resources, educational outreach, and customized assistance through IdentityTheft.gov) to consumers on ways to respond to data breaches, identity theft, and related harm. Approximately 13 percent of those affected by the 2015 OPM breaches used credit and identity monitoring and identity restoration services that OPM offered them and a fraction of a percent made identity theft insurance claims (the payouts for which averaged $1,800). Data we assessed for this report support a 2017 recommendation we made to the Office of Management and Budget (OMB) to revise guidance to federal agencies about responding to data breaches and one to Congress to consider permitting agencies to determine appropriate levels of identity theft insurance offered after data breaches.

FTC Is Primary Provider of Federal Assistance to Consumers Affected by Data Breaches and Identity Theft

Federal Trade Commission

FTC, as a primary source for assistance to consumers on issues related to data breaches and identity theft, provides guidance and assistance through its website and through conferences and workshops.

Online and printed resources. FTC’s home page includes links to identity theft-related resources, including information about key options consumers can consider to help them mitigate identity theft risks and other harms, and a link to IdentityTheft.gov (discussed later in this section). FTC updates the information regularly, such as after large-scale data breaches.

Outreach. FTC maintains relationships with state government, law enforcement, and community and consumer organizations, through which it conducts outreach about how to respond to exposure or loss of personal information and identity theft mitigation. For example, FTC collaborated with the International Association of the Chiefs of Police to update the association’s model policy for identity theft to include referral information for IdentityTheft.gov. FTC also has held webinars, conferences, and workshops on topics related to data breaches and identity theft for groups including government officials, nonprofits, and the general public.

Customized assistance (IdentityTheft.gov). FTC provides information and customized assistance through IdentityTheft.gov to individuals whose information was lost or stolen or who experienced identity theft or other harm, such as tax refund fraud. During fiscal year 2018, IdentityTheft.gov received almost 2 million unique visitors. The website in its current form has been in place since January 2016 and offers the following types of assistance:

Steps to take after identity theft. IdentityTheft.gov provides individual victims with step-by-step instructions to resolve specific problems. From January 2016 (when FTC launched the current version of IdentityTheft.gov) through October 1, 2018, approximately 700,000 individuals set up and activated accounts on the website to help them recover from identity theft. Individuals who set up accounts can indicate what kind of information was stolen and what kind of adverse event they experienced. The site helps users generate pre- filled letters, affidavits, and forms to send to consumer reporting agencies, businesses, debt collectors, and IRS, as appropriate. For example, individuals who fill out an Identity Theft Report affidavit can use this report instead of filing a police report to request extended 7- year fraud alerts (available to identity theft victims) on their credit reports. In addition, individuals who experienced tax refund fraud can fill out a form on IdentityTheft.gov that is then submitted directly to IRS. An individual who experienced credit card fraud would be advised to take different steps than one who experienced fraud related to utility bills or medical insurance.

Steps to take after data breaches or loss of personal information.

IdentityTheft.gov/databreach provides checklists and suggestions for people whose personal information was lost or exposed but has not yet been misused.

FTC also maintains an online chat function and telephone number for those who need additional assistance. For complex cases, FTC staff may refer individuals to the Identity Theft Resource Center, a nonprofit organization.

We found that in developing and updating the website, FTC followed some key practices for consumer education planning. One key practice we identified was consulting with stakeholders. According to FTC staff we interviewed and documentation we reviewed, FTC obtained feedback from stakeholders such as law enforcement agencies and community organizations in developing IdentityTheft.gov. Another key practice we identified was assessing users’ needs. FTC conducted usability testing to ensure the site’s features were easy to use. FTC staff also told us that after receiving user feedback, they made it easier for users to set up an account. FTC also made changes to IdentityTheft.gov—such as incorporating the ability to auto-generate forms—to implement a 2014 Executive Order calling for federal agencies to centralize identity theft information at the website. Furthermore, in January 2018, FTC implemented a new function that allows users who report identity theft tax refund fraud to file reports directly with IRS. Since its launch in early 2018 through October 1, 2018, almost 22,000 IRS Identity Theft Affidavits (IRS Form 14039) were submitted to IRS through IdentityTheft.gov. In general, experts across consumer, government, and industry organizations and identity theft service providers we interviewed expressed the view that IdentityTheft.gov is a valuable or user-friendly resource.

Other Federal Agency Resources

Other federal agencies provide assistance to consumers on topics related to identity theft, including CFPB, the Department of Justice, IRS, and the Social Security Administration.

CFPB. CFPB enforces, supervises for compliance with, and issues regulations to implement the federal consumer financial laws that address certain firms’ and financial institutions’ practices, which may include data security. A few of these laws and regulations contain provisions that can help protect the personal information of consumers. CFPB also offers consumer education resources.

Similarly to FTC, CFPB included information about how consumers can address risks related to exposure of personal information and recover from identity theft in the bureau’s overall consumer education activities. CFPB provides consumer education materials related to data breaches and identity theft through its blog and its financial education resource, “Ask CFPB.” CFPB also maintains relationships with external groups, such as librarian networks. CFPB provides links to FTC resources about data breaches and identity theft topics on its website, so as not to duplicate efforts, according to CFPB staff. The two agencies also have coordinated some efforts. FTC and CFPB published a jointly produced blog post on September 21, 2018, the date the new free credit freeze and 1-year fraud alert provisions took effect. Such coordination is consistent with the 2014 Executive Order, which designated FTC as a centralized source of information about identity theft across the federal government.

Staff of both agencies said that in developing new resources, they monitor information from a variety of sources, including consumer complaints, news and social media, and reports from other government entities, law enforcement, or nongovernmental stakeholders.

Other federal and state agencies. IRS and the Social Security Administration provide some assistance to consumers for specific types of identity theft. For example, as noted previously, IRS provides some taxpayers with PINs if they are victims of identity theft tax refund fraud. In addition, states enforce laws and regulations and provide consumer education resources and assistance to consumers at risk of identity theft and other harms as a result of data breaches. For example, the Illinois Attorney General’s office maintains a call-in number for victims of identity theft, and the Colorado Bureau of Investigation can assist residents with identity theft issues.

Few People Used Identity Theft Services OPM Provided, Very Few Made Insurance Claims, and Payouts Received Were Low

OPM offered identity theft services to approximately 22.1 million individuals whose personal information was compromised during the 2015 data breaches at OPM. Personnel records or OPM systems containing information from the background investigations of current, former, and prospective federal employees and other individuals were breached. The services, offered at no cost to affected individuals, included credit monitoring, identity monitoring, identity restoration services, and identity theft insurance. To receive credit and identity monitoring services, affected people have to enroll with the identity theft service provider with which OPM contracted, but identity theft insurance and identity theft restoration services are available to the entire affected population whether or not they enroll.

Few affected individuals have used the services. According to data from OPM, as of September 30, 2018, close to 3 million, or 13 percent, of individuals affected by the 2015 incidents had made use of the services. As seen in figure 2, the great majority of enrollments occurred in the months immediately following notification of the breach. OPM staff said that the spike in enrollments in July and August 2016 likely was due to the follow-up mailing that OPM sent to approximately 10 percent of affected individuals whose mailing addresses were incorrect in the original mailing of notifications.

In addition, according to OPM-reported data we reviewed, of the 3 million individuals who used the services, about 1 percent made identity restoration requests and a fraction of 1 percent submitted insurance claims. According to data we reviewed, approximately 27,000 identity restoration cases had been resolved as of September 30, 2018. In addition, 61 insurance claims (of 81 submitted) had been paid, totaling $112,000, with an average payout of $1,800.

Since 2015, OPM has obligated approximately $421 million for identity theft services and as of November 30, 2018, OPM paid out approximately $361 million of the obligated funds. OPM is required to provide identity theft services through September 2026. The contract to provide these services on behalf of OPM expired in December 2018; OPM re-competed and awarded a single contract that month to ID Experts, the company that had been providing these services.

After the OPM breaches in 2015, OPM provided federal employees and other affected individuals with information and guidance about their options in mailed letters and on its website. On its website, OPM developed a Cybersecurity Resource Center and included background about the breaches and who was affected; instructions for how to enroll in identity theft services; and a Frequently Asked Questions webpage that included links to FTC resources, including IdentityTheft.gov. OMB’s 2017 policy guidance to federal agencies, including OPM, states that agencies should determine appropriate information to provide to affected individuals and review breach responses annually. Consistent with that guidance, OPM’s September 2017 Breach Response Plan calls for the agency to review its breach response plan annually, including to reinforce or improve training and awareness. In December 2018, OPM updated its website to incorporate changes in the cost of credit freezes and duration of fraud alerts resulting from new legislation we discussed earlier.

OMB Has Not Revised Post-Data Breach Guidance to Agencies and Insurance Coverage Amount for Identity Theft Insurance Remains High

Data we assessed for this report support a 2017 recommendation we made to OMB and a matter for congressional consideration, both of which have not yet been implemented. In our March 2017 report, we found that OMB policy guidance for federal agencies on how to prepare for and respond to data breaches did not address how agencies might assess the effectiveness of identity theft services relative to lower-cost alternatives. For example, the guidance did not discuss whether identity theft services would be preferable to alternatives (such as fraud alerts, credit freezes, or the agency conducting its own database monitoring). We concluded that the guidance might not fully reflect the most useful and cost-effective options agencies should consider in response to a breach—contrary to OMB’s risk-management and internal control guidance calling on federal leaders to improve effectiveness and efficiency. Therefore, we recommended that OMB conduct an analysis of the effectiveness of identity theft services relative to alternatives, and revise its guidance to federal agencies in light of the analysis. In oral comments on a draft of the 2017 report, staff from OMB’s Office of Information and Regulatory Affairs said that our draft recommendation to OMB on expanding OMB’s guidance to federal agencies would benefit from greater specificity, and we revised this recommendation to provide greater clarity.

We contacted OMB several times between May 2018 and early March 2019 to update the status of this recommendation but as of March 2019, OMB had not responded with an update. In our current review, we found that information on the effectiveness of various consumer options continues to be limited. We also found that some free and low-cost alternatives to free or fee-based identity theft services can prevent or more directly address new account fraud and some options consumers can take on their own have become less burdensome. Therefore, we stand by this recommendation.

In addition, as noted previously in this report, the identity theft insurance that OPM offered to affected individuals resulted in few insurance claims, and the amounts claimed have been small. These data are consistent with the findings of our 2017 report—which reported that the number and dollar amount of claims for identity theft generally were low. They also reinforce our conclusion that the $5 million per-person coverage limit mandated by Congress likely was unnecessary and might impose costs without providing a meaningful corresponding benefit. Specifically, we noted that $5 million in coverage would increase federal costs unnecessarily, likely mislead consumers about the benefit of the product, and create unwarranted escalation of coverage amounts in the marketplace.

Therefore, we reiterate the matter for congressional consideration we made in our March 2017 report: in the event that Congress again requires an agency to provide individuals with identity theft insurance in response to a breach, it should consider permitting the agency to determine the appropriate level of that insurance.

Agency Comments

We provided a draft of this report to CFPB, FTC, and OPM. The agencies provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Director of CFPB, the Chair of FTC, and the Acting Director of OPM. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions concerning this report, please contact me at (202) 512-8678 or ortiza@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report examines (1) information and expert views about the effectiveness of options consumers can use to prevent or address the risks resulting from data breaches; and (2) federal assistance available to help consumers understand these options, including the status of one matter for congressional consideration and one recommendation relating to these issues in our 2017 report.

To address the first objective, we conducted a literature review to identify any studies or independent research on the effectiveness of various options consumers have for mitigating data breach harms, consumer attitudes and behavior following data breaches, and identity theft and other harm to individuals from exposure of personal information. We searched databases of scholarly publications and other sources for work generally published within the last 5 years. Examples of databases searched include ProQuest, EconLit, Policy File Index, and SciTech Premium Collection. We searched for terms including “effective,” “data breach,” “identity theft,” “consumer attitudes,” and “consumer behavior” and options such as “credit freeze,” “fraud alert,” and “credit lock.” We also reviewed relevant academic literature to identify additional studies. From these searches, we did not identify any studies that assessed the extent to which commercial identity theft services were effective in preventing or mitigating harm from exposure of personal information. We identified and reviewed 54 studies that appeared in peer-reviewed journals or research institutions’ publications and were relevant to consumer attitudes and behavior related to privacy, data breaches, and identity theft.

To ensure the selection of a range of perspectives on the effectiveness of options to mitigate harms, we reviewed the selection of experts and sources in our prior report and our literature review, and updated that selection through additional searches and recommendations from discussions with experts and identity theft service providers and review of relevant literature. We defined experts as those representing consumer and industry policy organizations that have conducted research or taken policy positions on consumers’ or entities’ options after data breaches; academics who conducted research on relevant topics; and federal and state government staff with specific positions of responsibility in consumer protection or education. We also contacted seven companies that provide identity theft services to consumers.

We interviewed representatives of a nongeneralizable sample of 35 entities in the following categories: academic or independent research institution (4); consumer or privacy research and advocacy (10); industry association, identity theft service provider, or industry consultant (12); and federal or state government (9). We also reviewed relevant consumer education and other materials produced by consumer, government, industry, and other entities. We interviewed academics from Carnegie- Mellon University, RAND Corporation, the University of Maryland, and the University of Rochester. In addition, we interviewed representatives from the following organizations:

Consumer or privacy groups: AARP, Consumer Action, Consumer Federation of America, Consumer Reports, Electronic Privacy Information Center, Identity Theft Resource Center, National Consumer Law Center, Privacy Rights Clearinghouse, U.S. PIRG, and World Privacy Forum.

Industry associations or consultants: American Bankers Association, Consumer Data Industry Association, Property and Casualty Insurers Association of America, National Retail Federation, and Rational 360.

Identity theft service providers: Credit Karma, Equifax, Experian, ID Experts, ID Shield, LifeLock, and TransUnion.

Government agencies: Consumer Financial Protection Bureau (CFPB), Federal Reserve Bank of Philadelphia, Federal Trade Commission (FTC), Office of Personnel Management (OPM), and Offices of the Attorney General of California, Connecticut, Illinois, Massachusetts, and New York.

Throughout this report, we use certain qualifiers when describing responses from interview participants and views of entities whose articles and written material we reviewed, such as “few,” “some,” and “most.” We define few as a small number such as two or three. The specific quantification of categories depends on the overall numbers of entities that addressed a specific topic. For example, we may refer to views shared by a proportion of the 10 consumer groups we interviewed, or those shared by identity theft service providers.

We also reviewed provisions in the Economic Growth, Regulatory Relief, and Consumer Protection Act, enacted in May 2018, that address credit freezes and fraud alerts (two tools for preventing new-account fraud).

To address the second objective, we reviewed and analyzed documentation and interviewed staff from FTC, CFPB, and OPM. We reviewed and analyzed FTC, CFPB, and OPM consumer education materials including blog posts, online fact sheets, and printed brochures and data on usage of the materials. For example, we analyzed FTC, CFPB, and OPM data and website analytics for their data breach- and identity theft-related web pages. We interviewed FTC and CFPB agency staff about their assistance to individuals and how they measure effectiveness of their efforts. We reviewed documentation and interviewed agency staff about the development, implementation, and assessment of consumer education materials and other resources and assistance. For example, we reviewed materials documenting FTC’s outreach to stakeholders and usability testing of IdentityTheft.gov. We compared the activities against a 2014 Executive Order on the security of consumer financial transactions, key practices for consumer education planning we identified in prior work, and federal standards for internal control.

We analyzed data from the company with which OPM contracted to provide identity theft services to the approximately 22.1 million individuals whose information was exposed in the 2015 data breaches. We obtained data on the number of enrollments, the number and size of identity theft insurance claims submitted and paid, and number of identity restoration cases the companies handled. We assessed the reliability of the data by interviewing agency officials and reviewing documentation about the systems used to store the data. We found the data to be reliable for purposes of this reporting objective. We also reviewed the online guidance OPM provided to affected individuals and assessed the guidance against Office of Management and Budget guidance for agencies following data breaches and OPM’s 2017 Breach Response plan.

In addition, for both objectives, we reviewed the evidence gathered and analyzed for the 2017 GAO report (GAO-17-254) and updated the status of the matter for congressional consideration and recommendations made in that report.

We conducted this performance audit from November 2017 to March 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: What Can Consumers Do After a Data Breach?

Appendix II: What Can Consumers Do After a Data Breach?

Figure 3 below provides information on actions consumers can take to monitor for identity theft or other forms of fraud, protect their personal information, and respond if they have been a victim of identity theft. This information summarizes prior GAO work and comments of academic, consumer organization, industry, and government experts.

Appendix III: GAO Contacts and Staff Acknowledgements

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Kay Kuhlman (Assistant Director), Meghana Acharya, Carl Barden, Bethany Benitez, Catherine Gelb (Analyst in Charge), Danielle Koonce, Jill Lacey, Kathleen McQueeney, Barbara Roesmann, Jena Sinkfield, and Meg Tulloch made significant contributions to this report.