Want CNET to notify you of price drops and the latest stories?

Free ways to protect against identity theft

Credit-reporting agencies, banks, and credit-card companies provide free services that help their customers detect, prevent, and recover from identity thieves.

Dennis O'Reilly Former CNET contributor
Dennis O'Reilly began writing about workplace technology as an editor for Ziff-Davis' Computer Select, back when CDs were new-fangled, and IBM's PC XT was wowing the crowds at Comdex. He spent more than seven years running PC World's award-winning Here's How section, beginning in 2000. O'Reilly has written about everything from web search to PC security to Microsoft Excel customizations. Along with designing, building, and managing several different web sites, Dennis created the Travel Reference Library, a database of travel guidebook reviews that was converted to the web in 1996 and operated through 2000.
Dennis O'Reilly
7 min read

Screenshot by Dennis O'Reilly/CNET

Identity thieves are more active than ever. In 2012, the Federal Trade Commission received more than 2 million consumer complaints overall, and for the 13th consecutive year, identity theft was the most-common complaint category: 369,132 ID-theft reports were added to the FTC's Consumer Sentinel Network in the year, an increase of more than 30 percent from 2011.

Last week the FTC released its 2012 Consumer Sentinel Network Data Book (PDF). According to the report, the fastest-growing category of identity theft relates to government documents and benefits: complaints in this category increased 46 percent from calendar-year 2010. Credit-card fraud (13 percent), phone or utilities fraud (10 percent), and bank fraud (6 percent) were the next most-common categories of ID theft in 2012.

The rise in identity-theft complaints may have you considering one of the many fee-based services that promise to defend against identity theft and other online crimes. Many experts consider such services a bad investment, particularly in light of the steps you can take to protect yourself against ID thieves without having to spend any money. Here are three identity-theft-prevention techniques that won't cost you a dime.

Get a truly free credit report straight from the source
The Fair Credit Reporting Act requires that each of the three credit-reporting agencies provide consumers with a free credit report upon request every 12 months. In response, Equifax, Experian, and TransUnion created AnnualCreditReport.com, which lets you ask for a free credit report online, via toll-free telephone number (1-877-322-8228), or by mail using a downloadable request form (PDF).

The service actually allows you to monitor your credit report three times a year by requesting a report from one of the three credit-reporting agencies every four months. This may be more monitoring than many consumers require, unless they recently applied for new credit accounts or plan to do so in the near future.

Note that you're also entitled to a free credit report within 60 days of being denied after applying for insurance, credit, or employment, or anytime a company takes an "adverse action" against you. If you're unemployed, on welfare, or have been the victim of identity theft, you may request a free credit report even if you've made a previous request within the past 12 months. Otherwise, the credit-reporting agencies charge up to $11 for a second report within one year.

The free report doesn't include your FICO score, which is the three-digit number between 300 and 850 that companies use to determine your credit-worthiness. Services such as Credit Karma and MyFico claim to provide free credit reports and FICO scores, but Credit Karma makes money from the "consumer data" it collects, and MyFico offers only a free 10-day trial of its $15-a-month Score Watch service, so you have to supply a credit-card number to start the trial and discontinue the service during the trial period to prevent the charge from going through.

At first blush, the Credit Karma offer looks inviting, but I wasn't comfortable with the amount of personal information the company collects, as described in the Credit Karma privacy policy. Much of the information is needed to access your credit report, but the difference is that the credit-report agencies already have this information. Why provide it to yet another third party, even one that is otherwise trustworthy?

The site Whatsmyscore.org offers a free FICO Score Estimator that asks 10 questions and uses the answers to generate an estimated score for each of the three credit-reporting agencies.

Whatsmyscore.org FICO Score Estimator results
The free FICO Score Estimator at Whatsmyscore.org generates a guess at your score based on your answers to 10 questions. Screenshot by Dennis O'Reilly/CNET

Many of the companies that promise you a free credit report are scams that surreptitiously sign you up for paid services you don't want or need. In October 2011 the FTC released a scam alert warning against sites with "free report" or similar phrases in their URLs, or that typo-squat "annualcreditreport.com," which is the only true source for free credit reports.

When you spot errors on your credit report, contact the credit-reporting agency in writing and include copies of documents that support your claims that the information is inaccurate. The FTC's instructions for disputing errors in credit reports include a sample disputation letter to a credit-reporting agency.

FTC sample credit-report dispute letter
The FTC's instructions for disputing errors in your credit report include a sample letter to the credit-reporting agency. Screenshot by Dennis O'Reilly/CNET

The agency must contact the source of the information, and that company is required to investigate the claim, review the material you provided, and report back to the credit-reporting agency. The information provider must notify all three credit agencies if it determines the information is indeed inaccurate. The credit agency must then send you a free copy of your amended report that doesn't count as your one free yearly report.

You can also request that the agency send the revised report to anyone who requested a copy in the previous six months, or to any potential employers who received your report in the past two years.

Put activity and fraud alerts to good use
Once you're confident your credit report is accurate, contact your bank or credit-card providers to request alerts when purchases over a certain amount are charged to the account, or when charges are received from overseas. (Note that most financial services will contact you automatically when they detect unusual or suspicious activity on your account.)

If you believe you've been a victim of an identity-theft crime or attempt, contact one of the credit-reporting agencies about having a fraud alert placed on your accounts. When you file a fraud alert with one of the three agencies, the company is required by law to contact the other two agencies.

The fraud alert makes it more difficult to open a new credit account: lenders are instructed to contact you -- usually by phone -- to verify your identity before they can open an account in your name, although they aren't required by law to do so. Your name will be removed from all pre-approved credit offers for two years. The fraud alert is in place for only 90 days, but if you've been the victim of an identity-theft crime, you can extend the fraud protection to two years.

All three credit-reporting agencies let you apply for a fraud alert online:

A fraud alert applies only to new accounts, so your current credit accounts won't be affected. If you're planning to apply for a new credit account, you'll need to take the extra step of allowing the creditor to contact you or take other added steps to verify your identity.

You can take the credit-protection a step further by requesting a freeze on your account. As with fraud alerts, the freeze applies only to new accounts and doesn't affect your current credit accounts. If you've been victimized by one identity theft, the threat of subsequent attempts to steal your identity increases. An account freeze can stop such attacks in their tracks.

Unfortunately, freezing your credit accounts is governed by state law, and at present Indiana is the only state that allows its residents to apply for, suspend temporarily, and remove a credit freeze for free. In other states the fee for applying a credit freeze ranges from $3 to $20. Consumers Union provides a state-by-state Guide to Security Freeze Protection.

The site Man vs. Debt offers step-by-step instructions for applying for a credit freeze at the three credit-reporting agencies. According to the site, Experian and TransUnion allow you to request a freeze online, but Equifax requires that the request be in writing. You can also request a freeze from the three companies via toll-free telephone numbers.

Check your identity-theft insurance coverage
Identity-theft insurance policies are a bad deal for consumers, as Consumer Reports found in an advisory issued in February 2012 titled "Debunking the hype over ID theft." That report found that uninsured victims of identity theft incurred out-of-pocket expenses averaging $631, while victims who had identity-theft insurance had an average out-of-pocket loss of $587.

Check with your insurance carrier to determine whether your home-owner's, renter's, or other existing policy covers losses due to identity theft. In particular, umbrella insurance policies nearly always include protection against losses or expenses resulting from identity theft.

Your bank may want to charge a monthly fee for its identity-theft protection, but your accounts are already protected by the Electronic Funds Transfer Act, which caps losses by consumers due to unauthorized access to their bank accounts when the losses are reported in a timely manner. The FTC's Electronic Banking page explains the protection offered by the EFT Act.

Companies become the victims of identity theft
While some employers now offer identity-theft protection as a benefit to their employees, the irony is that companies are increasingly the victim of ID-theft crimes. The health-care industry in particular is a popular target of identity thieves, according to a recent Ponemon study.

According to the report, medical service providers often fail to properly identify the people they treat. This makes it easier for an uninsured patient to receive treatment using an insured patient's ID. A fraudulent entry in the insured patient's medical records could cause a misdiagnosis and endanger the patient.

While it can't match the seriousness of a doctor writing a potentially fatal prescription, all businesses are at risk of losing money because of identity theft. Companies may be liable for damages resulting from an employee's theft of private customer data, for example. The Nonprofit Risk Management Center offers employers tips for preventing identity theft from the inside out.