Feeds

Fraud guardian LifeLock accused of fraud

Experian called. It wants its alerts back

Securing Web Applications Made Simple and Scalable

Analysis One of the top three credit reporting services, Experian, has sued a small company that sells identity theft protection services, alleging that it engages in fraud by skirting consumer protection laws.

LifeLock charges about $10 per month to make a customer's credit data more secure by placing what is known as an "initial fraud alert" in files that are maintained by Experian and its competitors TransUnion and Equifax. These temporary reports require employees of the credit reporting bureaus to take additional steps to verify a creditor's credentials before divulging information contained in the records. According to Experian, LifeLock generates huge numbers of alerts that in many cases fraudulently assert that the customers are already victims of ID theft, or have good-faith reason to believe they are about to be victims.

"LifeLock's scheme costs Experian millions of dollars every year in processing large numbers of improper initial fraud alerts, mailing mandatory notices to consumers, and providing free credit reports to consumers who are not eligible for such reports," Experian's complaint states.

Experian also argues that LifeLock's business harms individuals and the overall economy. Consumers are deceived into thinking they must pay to have the alerts placed on their records - when in fact the consumers could issue their own alerts for free - and consequently may be deterred from getting them. It also clogs the system with bogus fraud alerts, which may have the effect of devaluing real ones.

LifeLock declined to comment on the lawsuit, except to say it intended to "vigorously defend the case."

What Experian doesn't tell you is that it derives a significant amount of revenue hawking services that compete with LifeLock's. It also fails to say that initial fraud alerts raise its overhead costs. Such alerts were only implemented through an act of Congress. They require credit bureaus to jump through additional hoops when confirming the identity of a person or business looking in to a person's credit.

Thanks to LifeLock, Experian has significantly more fraud alerts than it would probably have otherwise. Once upon a time, a phone number set up by the two-year-old startup registered as many as 1,000 fraud alerts per day using Experian's toll-free system. When the alerts expire in 90 days, LifeLock automatically renews them, and keeps on doing so ad infinitum every three months.

And that costs Experian money, not only by driving up the costs of verifying the credentials of creditors, but also in lost revenue for competing services.

But Experian's undisclosed financial motives don't necessarily mean its legal argument is without merit. Under the Fair Credit Reporting Act, fraud alerts are only available to victims, or people who have good reason to believe they are about to become victims, and then only for 90 days. LifeLock wants to use the law as a means to proactively safeguard ID theft, and it's not at all clear this is what Congress intended.

What's more, it can be argued that LifeLock's own advertising gives consumers a false sense of security. CEO Todd Davis is fond of publicly divulging his social security number as a testament to his confidence in LifeLock's services. But the fraud alerts placed with credit bureaus don't actually prevent con-men from taking out credit under a victim's identity. They only make it more difficult.

"The concern among consumer groups is that the fraud alert in and of itself is not an effective identity theft tool because it doesn't actually prevent a creditor from issuing credit to an identity thief," says Jeannine Kenney, a senior policy analyst focusing on identity theft for Consumers Union.

Indeed, according to this article, LifeLock's services didn't even prevent Davis from becoming a victim.

Far more effective are security freezes, which are available to consumers in most states now. They put a lock on consumers' credit reports so no one can get access to them, period.

They're not free, but they're significantly cheaper than services offered by either Experian or LifeLock. And that's something else neither side wants you to know. ®

Mobile application security vulnerability report

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.