Equifax Breach Will Fuel Identity Theft Remediation Debate

The GAO report was issued at the request of members of Congress in the wake of two high-profile data breaches experienced by the Office of Personnel Management (OPM), which exposed the personal information (including background investigations and other personnel records) of approximately 22.1 million individuals. OPM awarded two contracts obligating about $240 million for identity theft services as a result.

The GAO report examined several relevant issues, including the potential benefits and limitations of identity theft services, and factors that affect government and private-sector decision-making about such services. While the purpose of the GAO report is to make recommendations to Congress regarding data breach responses of federal agencies, the report has implications for the private sector as well.

In compiling the report, the GAO reviewed the websites of 26 providers of identity theft services, as well as relevant studies and federal enforcement decisions. The GAO also interviewed decision-makers representing federal agencies and private entities regarding how they chose which services to provide following a data breach.

The GAO report identified several limitations of the four most common types of identity theft services.

Credit monitoring helps detect new-account fraud (that is, the opening of new unauthorized accounts) by alerting users when their personal information is used in connection with a new loan, credit card or other account. While early detection can be useful, credit monitoring is limited in effect because it does not prevent new-account fraud or address fraud with respect to existing accounts, such as misuse of a stolen credit card number.

While new-account fraud is on the rise, partly due to the increased availability of microchipped payment cards, existing-account fraud continues to be a significant issue. According to the Bureau of Justice Statistics, a substantial majority of identity theft victims (86%) experienced fraud relating to existing account information. Further, a study published by Javelin Strategy & Research in February of this year found that in 2016, incidence of fraud related to account takeovers rose 31% from 2015.

Consumers have alternatives to credit monitoring that can prevent certain types of fraud. Free fraud alerts and low-cost credit freezes can prevent new-account fraud by requiring businesses to verify the consumer's identity prior to issuing credit and restricting access to the consumers' credit report, respectively. But the consumer has to lift the freeze before they can obtain new credit, so a freeze may not be optimal in all situations.

Identity monitoring can alert consumers to misuse of certain personal information by monitoring sources such as public records or illicit websites. Identity monitoring services scan sources other than credit reports (including public records, proprietary databases and black-market websites) and alert consumers when they detect new or inaccurate information, or when they detect the consumers' personal information in inappropriate places. Similar to credit monitoring services, identity-monitoring services allow the consumer to benefit from early detection. They have the added benefit that they access sources that might not be readily available to the average consumer, but their effectiveness at preventing identity theft is unclear.

Identity restoration seeks to remediate the effects of identity theft, but the level of service varies. Some providers offer hands-on assistance, such as contacting financial institutions to dispute fraudulent accounts or contacting credit bureaus to report errors or place fraud alerts on the consumer's behalf. But others largely provide self-help information, which is of more limited benefit.

Identity theft insurance covers certain expenses of identity restoration, but coverage generally excludes direct financial losses, and the number and dollar amount of claims has been low. According to the Bureau of Justice Statistics, in 2014, only 5% of all identity theft victims reported indirect losses — defined as expenses such as legal fees, postage, notary fees and other miscellaneous expenses — associated with their most recent incident of identity theft. The average indirect loss was $261, and half of all indirect losses were less than $10.
*****
Angela R. Matney is an attorney with Hirschler Fleischer in Fredericksburg, VA, who counsels employers on information privacy compliance. She is a Certified Information Privacy Professional (CIPP), and may be reached at 540-604-2117 or by e-mail at [email protected].