Feeds

Fraud guardian LifeLock accused of fraud

Experian called. It wants its alerts back

Choosing a cloud hosting partner with confidence

Analysis One of the top three credit reporting services, Experian, has sued a small company that sells identity theft protection services, alleging that it engages in fraud by skirting consumer protection laws.

LifeLock charges about $10 per month to make a customer's credit data more secure by placing what is known as an "initial fraud alert" in files that are maintained by Experian and its competitors TransUnion and Equifax. These temporary reports require employees of the credit reporting bureaus to take additional steps to verify a creditor's credentials before divulging information contained in the records. According to Experian, LifeLock generates huge numbers of alerts that in many cases fraudulently assert that the customers are already victims of ID theft, or have good-faith reason to believe they are about to be victims.

"LifeLock's scheme costs Experian millions of dollars every year in processing large numbers of improper initial fraud alerts, mailing mandatory notices to consumers, and providing free credit reports to consumers who are not eligible for such reports," Experian's complaint states.

Experian also argues that LifeLock's business harms individuals and the overall economy. Consumers are deceived into thinking they must pay to have the alerts placed on their records - when in fact the consumers could issue their own alerts for free - and consequently may be deterred from getting them. It also clogs the system with bogus fraud alerts, which may have the effect of devaluing real ones.

LifeLock declined to comment on the lawsuit, except to say it intended to "vigorously defend the case."

What Experian doesn't tell you is that it derives a significant amount of revenue hawking services that compete with LifeLock's. It also fails to say that initial fraud alerts raise its overhead costs. Such alerts were only implemented through an act of Congress. They require credit bureaus to jump through additional hoops when confirming the identity of a person or business looking in to a person's credit.

Thanks to LifeLock, Experian has significantly more fraud alerts than it would probably have otherwise. Once upon a time, a phone number set up by the two-year-old startup registered as many as 1,000 fraud alerts per day using Experian's toll-free system. When the alerts expire in 90 days, LifeLock automatically renews them, and keeps on doing so ad infinitum every three months.

And that costs Experian money, not only by driving up the costs of verifying the credentials of creditors, but also in lost revenue for competing services.

But Experian's undisclosed financial motives don't necessarily mean its legal argument is without merit. Under the Fair Credit Reporting Act, fraud alerts are only available to victims, or people who have good reason to believe they are about to become victims, and then only for 90 days. LifeLock wants to use the law as a means to proactively safeguard ID theft, and it's not at all clear this is what Congress intended.

What's more, it can be argued that LifeLock's own advertising gives consumers a false sense of security. CEO Todd Davis is fond of publicly divulging his social security number as a testament to his confidence in LifeLock's services. But the fraud alerts placed with credit bureaus don't actually prevent con-men from taking out credit under a victim's identity. They only make it more difficult.

"The concern among consumer groups is that the fraud alert in and of itself is not an effective identity theft tool because it doesn't actually prevent a creditor from issuing credit to an identity thief," says Jeannine Kenney, a senior policy analyst focusing on identity theft for Consumers Union.

Indeed, according to this article, LifeLock's services didn't even prevent Davis from becoming a victim.

Far more effective are security freezes, which are available to consumers in most states now. They put a lock on consumers' credit reports so no one can get access to them, period.

They're not free, but they're significantly cheaper than services offered by either Experian or LifeLock. And that's something else neither side wants you to know. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.