Should you get identity theft protection? Here’s what it does

If you’d asked me in 2018 whether I was likely to be a victim of identity theft, I would have said no.

I used free credit monitoring. I had unique passwords and two-factor authentication on all my bank accounts and the email address that those accounts were linked to. I didn’t keep any personal identifying information in my wallet other than my driver’s license. I was tech-savvy and financially conscientious.
But after my wallet got stolen, it happened to me. It was a nightmare. And it could happen to you.

I wrote a story about my experience, along with ways to protect yourself and what to do if your identity is stolen. I also proposed some solutions that could make this crime harder to commit in the first place, and easier for victims after it does happen.

One thing I didn’t write about: ID theft insurance. Before my saga, I hadn’t used LifeLock or Aura or any service like that. I didn’t really know what they did, or whether they would have been helpful in my situation. But after my story came out, I started getting a lot of emails from readers asking whether they should get it.

So I decided to do some digging. Here’s what I learned, whether you should consider getting identity theft insurance, and whether I did.

What does identity theft protection do?

Identity theft insurance does not entirely prevent your identity from being stolen. Think of it more like AAA, said Eva Velasquez, the head of the Identity Theft Resource Center — it’s there to help you after the fact, but it doesn’t mean you’ll never blow a tire. Here’s what it does.

Services such as LifeLock monitor your credit as well as the use of your personal information. Free credit monitoring services including Credit Karma and Credit Sesame will track the three major credit bureaus (Equifax, Experian and TransUnion) for you and alert you when new inquiries and lines of credit appear. In my case, I started receiving emails when the thieves were attempting to open dozens of new store credit cards. ID theft insurance does this too. But there are more than 100 bureaus that track various types of financial activity, including checking accounts, utilities and payday loans. Identity theft protection services will monitor those as well as the three big players, and alert you whenever your personal financial information is used.

David Putnam, the head of identity for LifeLock — which is the largest and probably the best-known service of this kind, though certainly not the only one — said the company has relationships with banks, state governments, and other institutions that allow it to monitor customers’ personal data beyond what free services offer. In my case, he said I would have been alerted “almost instantly” when the thieves opened checking and savings accounts at Bank of America and Wells Fargo.

So identity theft protection will monitor how your financial identity is being used in more places than just the credit bureaus, and will probably let you know faster if your identity is being used in some way. That’s one piece of it.

Another piece is handling cleanup if your identity does get stolen. If I’d had ID theft insurance when my identity was stolen, that company would have handled the many frustrating phone calls, emails and reports for me.

The exact details would depend on the plan you choose, but generally speaking, you’re eligible to be reimbursed for any money you lose in the process of having your identity stolen, both in lost funds and personal expenses, as well as related legal help — for instance, if you were wrongfully arrested for something your identity thief had done and needed a lawyer.

Many also offer “dark web monitoring” that will tell you when your data comes up on one of the darker corners of the Internet. At this point, everyone’s information is almost certainly somewhere on the dark web, and credit monitoring services can’t remove it all. But being aware of it might be a good reminder to, say, change your password for something if it came up in a leak.

How much does identity theft insurance cost?

According to a comparison from U.S. News and World Report, identity theft protection will cost you about $10 to $40 a month, depending on the plan you select. But you might already get it for free or at a discount through your employer, your credit card perks, your bank or credit union, your homeowner or renters insurance, or an organization such as AAA, Costco or AARP.

Also, if you’ve been a victim in a data hack — which hundreds of millions of people have at this point — you might be eligible for some form of monitoring from that.

Will it help if your identity has already been stolen?

Most identity theft insurance companies won’t help you with things that happened before you had a policy with them. “For the most part the industry doesn’t go backwards,” Putnam said.

But your provider will help you clean up any future incidents, which are almost inevitable if you’ve been a victim of identity theft already. And the monitoring will help you know sooner when someone is trying to use your identity again or open another account.

Should you get identity theft protection?

Even though I’m a victim of identity theft, I don’t think everyone necessarily needs to pay for identity theft insurance. Would it have helped me? Yes. But if I had frozen my credit before the thieves got their hands on my wallet, they probably would have had trouble opening any new checking accounts. Because I used free credit monitoring and acted quickly, I was able to foil them before they could take out any credit cards in my name. They still would have been able to use my driver’s license, because California does not flag licenses that have been reported stolen to banks or law enforcement.

“There are really powerful ways to protect yourself for free, and you don’t need to sign up for these services to have this protection,” said Kimberly Palmer, a personal finance expert for NerdWallet. (Keep reading to see what those free methods are.)

If you’re willing to monitor your credit closely and deal with the fallout if your identity does get stolen, then you might not need an additional insurance policy. The New York Times declared “most people shouldn’t pay for identity theft protection” back in 2020.

But if you are at high risk of identity theft, you should consider it. The No. 1 risk factor: being a previous victim. People who are elderly or who have had their personal data compromised in a data breach are also at higher risk. If you’re in one of those groups, evaluate your budget and your willingness to dig yourself out from under someone else’s crime heap, and make your decision accordingly.

Even if you do choose to sign up, “it doesn’t mean you can abdicate all responsibility” for keeping your identity safe, Velasquez said. You still need to practice good personal data hygiene, such as keeping an eye on your bank statements and using secure passwords.

How do you choose which identity theft insurance to buy?

First, double-check whether you already get it for free or at a discounted rate through your job (check with your human resources department), your insurance (call customer service), a financial institution such as your credit union or through a credit card, or as a benefit of a data breach settlement.

When you’re shopping for an off-the-shelf plan, “make sure you understand what you’re signing up for,” Palmer said. “Providers offer different layers or tiers. Are you getting just monitoring, active alerts, meaningful recovery, what exactly will they help you with? Are you signing up for a more simple version or a higher-end version?”

In some cases, the most basic tier of plans are just credit monitoring, which you can do yourself for free. You want to make sure you’re getting enhanced personal information monitoring and have access to help if your identity gets stolen.

You can review plans and price comparisons at NerdWallet, U.S. News and World Report, CNBC, and CNET.

How to prevent identity theft

There are quite a few steps you can take to protect your identity without spending any money. You can do every single one of these things and still become a victim of identity theft — but they’ll go a long way toward preventing it.

1. Freeze your credit with the three major credit bureaus. It only took me 15 minutes to do this with Equifax, TransUnion and Experian, and even less time to unfreeze my credit when I needed to. It is free to freeze and unfreeze your credit — you don’t need any paid “upgrades.”
2. Use unique passwords and two-factor authentication wherever possible. Yes, it’s annoying to wait 10 seconds for a text message when you log into your bank account. But that tiny wrinkle of friction adds a major barrier to anyone who would try to gain access to it. In my case, the thieves were never able to get into my bank accounts or my email, despite multiple attempts.
3. Sign up for alerts from your bank. Configure it so you get a text or email (or both) whenever someone does something to your account, such as changing your password or adding a new account. I was alerted instantly when my thieves tried to open a new checking account at one of my banks.
4. Check your bank statements. Look at your bank and credit card transactions regularly and call if you see anything funky. The sooner you address it, the better the chance that the charge can be reversed.
5. Check your credit report. You are eligible to receive a free copy of your credit report once a year from each of the three major bureaus. You can request all three at once, or space them out during the year. Make sure there’s nothing on there you don’t recognize.
6. Don’t carry your Social Security card in your wallet. Yes, it’s likely that savvy thieves can get your Social Security number — and loads of other information about you — somewhere online. But don’t make it easy for them.
7. Opt out of pre-screened credit card offers. Thieves can pluck these from your mailbox and get a goldmine of personal information. Visit optoutprescreen.com and stop them from being mailed to you.
8. Never, ever give out your bank password or verification code. If someone calls you and says, “We need you to tell us your password to verify that it’s you”; or “We just sent you a six-digit code — can you repeat it back to us for verification?”, hang up. No financial institution will ever ask for that information.
9. Stop mail if you’re traveling, and don’t let it linger in your mailbox. Minimize opportunities for thieves to get your personal information (or new checkbooks) from your physical inbox.
10. Limit your digital presence. How much are you sharing, and where? Are things such as your mother’s maiden name or your hometown pretty easy to discern from your Facebook profile? Lock down your profiles as much as possible, and think twice before telling every website that asks what your birthday is. If you want to take this to the next level, use a service such asDeleteMe, which removes your personal information from data aggregators (for a price).

What about me? Did I buy identity theft insurance?

Before I had my identity stolen, I would have said no. I didn’t think I was at risk of being a victim, and figured I’d be able to sort it out myself if I was. I was wrong about the first part, and right about the second part — but it came at the expense of my sanity and countless hours of unpaid and stressful work fighting automated bank hold menus.

During open enrollment this year, I found out my company is offering a popular identity theft insurance policy at a discounted group rate. I haven’t heard anything from my thieves since 2020, but people who have been victims of identity theft before are very likely to become victims again. I’m more protected now because I leave my credit frozen, but I learned through my reporting that there are a lot of holes in the system that the thieves can squeeze through.

I asked Velasquez whether it would have saved me time and stress if I’d had a policy back in 2019.

“It would have saved you an extraordinary amount of time,” she said.

That’s all I needed to hear. I signed up.