Credit and identity monitoring

Credit and identity monitoring is a free service offered to people whose data has leaked: it warns them when credit is opened in their name or their identity is misused, and pays to set things right after identity theft. On July 22, 2019, Equifax signed a settlement with the FTC (Federal Trade Commission), the CFPB (Consumer Financial Protection Bureau) and the states worth at least $575 million over its 2017 breach, which had hit about 147 million people. The consumer fund could reach $425 million: $300 million up front, $125 million more if it ran dry. It paid for credit monitoring, identity restoration and documented losses. The product has two layers. Credit monitoring runs through the credit bureaus; identity monitoring extends to the dark web, address changes and Social Security number use. Identity restoration assigns a case manager to undo the theft. The offer usually runs twelve or twenty-four months, and some states mandate it when Social Security numbers leak: twenty-four months in Connecticut since October 1, 2018, one year in Delaware, eighteen months in Massachusetts since 2019. Outside those cases it is market practice, and a defense argument before a class action judge. For the underwriter, cost turns on the enrolment rate. It is low: Experian put it under one in ten in 2015, around 8% more recently. The policy pays for those who sign up, sometimes within notification costs, sometimes under its own sublimit; reserving for the whole file at full price overstates the claim. Friction points: the voluntary offer, not required by law, which some wordings exclude, and duration, when the insured promises three years instead of two. In Europe the practice barely exists, for lack of comparable credit bureaus; the line weighs mostly on U.S. files.