Feeds

Fraud guardian LifeLock accused of fraud

Experian called. It wants its alerts back

Reducing security risks from open source software

Analysis One of the top three credit reporting services, Experian, has sued a small company that sells identity theft protection services, alleging that it engages in fraud by skirting consumer protection laws.

LifeLock charges about $10 per month to make a customer's credit data more secure by placing what is known as an "initial fraud alert" in files that are maintained by Experian and its competitors TransUnion and Equifax. These temporary reports require employees of the credit reporting bureaus to take additional steps to verify a creditor's credentials before divulging information contained in the records. According to Experian, LifeLock generates huge numbers of alerts that in many cases fraudulently assert that the customers are already victims of ID theft, or have good-faith reason to believe they are about to be victims.

"LifeLock's scheme costs Experian millions of dollars every year in processing large numbers of improper initial fraud alerts, mailing mandatory notices to consumers, and providing free credit reports to consumers who are not eligible for such reports," Experian's complaint states.

Experian also argues that LifeLock's business harms individuals and the overall economy. Consumers are deceived into thinking they must pay to have the alerts placed on their records - when in fact the consumers could issue their own alerts for free - and consequently may be deterred from getting them. It also clogs the system with bogus fraud alerts, which may have the effect of devaluing real ones.

LifeLock declined to comment on the lawsuit, except to say it intended to "vigorously defend the case."

What Experian doesn't tell you is that it derives a significant amount of revenue hawking services that compete with LifeLock's. It also fails to say that initial fraud alerts raise its overhead costs. Such alerts were only implemented through an act of Congress. They require credit bureaus to jump through additional hoops when confirming the identity of a person or business looking in to a person's credit.

Thanks to LifeLock, Experian has significantly more fraud alerts than it would probably have otherwise. Once upon a time, a phone number set up by the two-year-old startup registered as many as 1,000 fraud alerts per day using Experian's toll-free system. When the alerts expire in 90 days, LifeLock automatically renews them, and keeps on doing so ad infinitum every three months.

And that costs Experian money, not only by driving up the costs of verifying the credentials of creditors, but also in lost revenue for competing services.

But Experian's undisclosed financial motives don't necessarily mean its legal argument is without merit. Under the Fair Credit Reporting Act, fraud alerts are only available to victims, or people who have good reason to believe they are about to become victims, and then only for 90 days. LifeLock wants to use the law as a means to proactively safeguard ID theft, and it's not at all clear this is what Congress intended.

What's more, it can be argued that LifeLock's own advertising gives consumers a false sense of security. CEO Todd Davis is fond of publicly divulging his social security number as a testament to his confidence in LifeLock's services. But the fraud alerts placed with credit bureaus don't actually prevent con-men from taking out credit under a victim's identity. They only make it more difficult.

"The concern among consumer groups is that the fraud alert in and of itself is not an effective identity theft tool because it doesn't actually prevent a creditor from issuing credit to an identity thief," says Jeannine Kenney, a senior policy analyst focusing on identity theft for Consumers Union.

Indeed, according to this article, LifeLock's services didn't even prevent Davis from becoming a victim.

Far more effective are security freezes, which are available to consumers in most states now. They put a lock on consumers' credit reports so no one can get access to them, period.

They're not free, but they're significantly cheaper than services offered by either Experian or LifeLock. And that's something else neither side wants you to know. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.