Feeds

Fraud guardian LifeLock accused of fraud

Experian called. It wants its alerts back

Protecting against web application threats using SSL

Analysis One of the top three credit reporting services, Experian, has sued a small company that sells identity theft protection services, alleging that it engages in fraud by skirting consumer protection laws.

LifeLock charges about $10 per month to make a customer's credit data more secure by placing what is known as an "initial fraud alert" in files that are maintained by Experian and its competitors TransUnion and Equifax. These temporary reports require employees of the credit reporting bureaus to take additional steps to verify a creditor's credentials before divulging information contained in the records. According to Experian, LifeLock generates huge numbers of alerts that in many cases fraudulently assert that the customers are already victims of ID theft, or have good-faith reason to believe they are about to be victims.

"LifeLock's scheme costs Experian millions of dollars every year in processing large numbers of improper initial fraud alerts, mailing mandatory notices to consumers, and providing free credit reports to consumers who are not eligible for such reports," Experian's complaint states.

Experian also argues that LifeLock's business harms individuals and the overall economy. Consumers are deceived into thinking they must pay to have the alerts placed on their records - when in fact the consumers could issue their own alerts for free - and consequently may be deterred from getting them. It also clogs the system with bogus fraud alerts, which may have the effect of devaluing real ones.

LifeLock declined to comment on the lawsuit, except to say it intended to "vigorously defend the case."

What Experian doesn't tell you is that it derives a significant amount of revenue hawking services that compete with LifeLock's. It also fails to say that initial fraud alerts raise its overhead costs. Such alerts were only implemented through an act of Congress. They require credit bureaus to jump through additional hoops when confirming the identity of a person or business looking in to a person's credit.

Thanks to LifeLock, Experian has significantly more fraud alerts than it would probably have otherwise. Once upon a time, a phone number set up by the two-year-old startup registered as many as 1,000 fraud alerts per day using Experian's toll-free system. When the alerts expire in 90 days, LifeLock automatically renews them, and keeps on doing so ad infinitum every three months.

And that costs Experian money, not only by driving up the costs of verifying the credentials of creditors, but also in lost revenue for competing services.

But Experian's undisclosed financial motives don't necessarily mean its legal argument is without merit. Under the Fair Credit Reporting Act, fraud alerts are only available to victims, or people who have good reason to believe they are about to become victims, and then only for 90 days. LifeLock wants to use the law as a means to proactively safeguard ID theft, and it's not at all clear this is what Congress intended.

What's more, it can be argued that LifeLock's own advertising gives consumers a false sense of security. CEO Todd Davis is fond of publicly divulging his social security number as a testament to his confidence in LifeLock's services. But the fraud alerts placed with credit bureaus don't actually prevent con-men from taking out credit under a victim's identity. They only make it more difficult.

"The concern among consumer groups is that the fraud alert in and of itself is not an effective identity theft tool because it doesn't actually prevent a creditor from issuing credit to an identity thief," says Jeannine Kenney, a senior policy analyst focusing on identity theft for Consumers Union.

Indeed, according to this article, LifeLock's services didn't even prevent Davis from becoming a victim.

Far more effective are security freezes, which are available to consumers in most states now. They put a lock on consumers' credit reports so no one can get access to them, period.

They're not free, but they're significantly cheaper than services offered by either Experian or LifeLock. And that's something else neither side wants you to know. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.