Feeds

Fraud guardian LifeLock accused of fraud

Experian called. It wants its alerts back

Providing a secure and efficient Helpdesk

Analysis One of the top three credit reporting services, Experian, has sued a small company that sells identity theft protection services, alleging that it engages in fraud by skirting consumer protection laws.

LifeLock charges about $10 per month to make a customer's credit data more secure by placing what is known as an "initial fraud alert" in files that are maintained by Experian and its competitors TransUnion and Equifax. These temporary reports require employees of the credit reporting bureaus to take additional steps to verify a creditor's credentials before divulging information contained in the records. According to Experian, LifeLock generates huge numbers of alerts that in many cases fraudulently assert that the customers are already victims of ID theft, or have good-faith reason to believe they are about to be victims.

"LifeLock's scheme costs Experian millions of dollars every year in processing large numbers of improper initial fraud alerts, mailing mandatory notices to consumers, and providing free credit reports to consumers who are not eligible for such reports," Experian's complaint states.

Experian also argues that LifeLock's business harms individuals and the overall economy. Consumers are deceived into thinking they must pay to have the alerts placed on their records - when in fact the consumers could issue their own alerts for free - and consequently may be deterred from getting them. It also clogs the system with bogus fraud alerts, which may have the effect of devaluing real ones.

LifeLock declined to comment on the lawsuit, except to say it intended to "vigorously defend the case."

What Experian doesn't tell you is that it derives a significant amount of revenue hawking services that compete with LifeLock's. It also fails to say that initial fraud alerts raise its overhead costs. Such alerts were only implemented through an act of Congress. They require credit bureaus to jump through additional hoops when confirming the identity of a person or business looking in to a person's credit.

Thanks to LifeLock, Experian has significantly more fraud alerts than it would probably have otherwise. Once upon a time, a phone number set up by the two-year-old startup registered as many as 1,000 fraud alerts per day using Experian's toll-free system. When the alerts expire in 90 days, LifeLock automatically renews them, and keeps on doing so ad infinitum every three months.

And that costs Experian money, not only by driving up the costs of verifying the credentials of creditors, but also in lost revenue for competing services.

But Experian's undisclosed financial motives don't necessarily mean its legal argument is without merit. Under the Fair Credit Reporting Act, fraud alerts are only available to victims, or people who have good reason to believe they are about to become victims, and then only for 90 days. LifeLock wants to use the law as a means to proactively safeguard ID theft, and it's not at all clear this is what Congress intended.

What's more, it can be argued that LifeLock's own advertising gives consumers a false sense of security. CEO Todd Davis is fond of publicly divulging his social security number as a testament to his confidence in LifeLock's services. But the fraud alerts placed with credit bureaus don't actually prevent con-men from taking out credit under a victim's identity. They only make it more difficult.

"The concern among consumer groups is that the fraud alert in and of itself is not an effective identity theft tool because it doesn't actually prevent a creditor from issuing credit to an identity thief," says Jeannine Kenney, a senior policy analyst focusing on identity theft for Consumers Union.

Indeed, according to this article, LifeLock's services didn't even prevent Davis from becoming a victim.

Far more effective are security freezes, which are available to consumers in most states now. They put a lock on consumers' credit reports so no one can get access to them, period.

They're not free, but they're significantly cheaper than services offered by either Experian or LifeLock. And that's something else neither side wants you to know. ®

New hybrid storage solutions

More from The Register

next story
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.