Credit Monitoring

Credit monitoring is a service that watches one or more of your credit files and notifies you when something is added to or changed in them: a new account, an inquiry, a change of address, a change to a credit limit, a delinquency, a public record. It answers the question "has something happened to my file?" and it answers it after the fact.

There is no general statutory definition of a commercial monitoring product, so the only place federal law says what monitoring must consist of is the narrow mandate for service members. Under 15 USC 1681c-1(k)(2) every nationwide consumer reporting agency must provide "a free electronic credit monitoring service that, at a minimum, notifies a consumer of material additions or modifications to the file of the consumer" to any consumer who supplies proof of active duty status and contact information. 16 CFR part 609, the Federal Trade Commission's implementing rule, then defines every operative term in that sentence. It is worth reading even if you are not eligible, because it is the only federal description of what a monitoring service is supposed to do.

Two adjacent things are commonly conflated with this one. A credit freeze restricts the bureau from releasing your file at all, which prevents rather than detects. A free credit report is the file itself, which you can request directly. Monitoring sits between them: it is a standing subscription to be told when the file moves.

What the mandated service has to catch is specified, and the specificity is the useful part. 16 CFR 609.2(l) defines "material additions or modifications" as significant changes to a consumer's file, including new accounts opened in the consumer's name and new collection accounts; inquiries or requests for a consumer report; material changes to a consumer's address; changes to credit account limits of $100 or greater; and negative information. Section 609.2(n) then defines negative information as accounts furnished as more than 30 days delinquent, accounts furnished as being included in bankruptcy petition filings, and new public records, "including, but not limited to, bankruptcy filings, civil court judgments, foreclosures, liens, and convictions".

The inquiry limb has an exclusion that changes what silence means. Under 609.2(l)(2)(i), an inquiry made for a prescreened list obtained in order to make a firm offer of credit or insurance, or made for the purpose of reviewing or collecting an account of the consumer, "shall not be considered a material addition or modification". So the two commonest categories of pull on a settled file, the marketing prescreen and the existing creditor's periodic review, are deliberately not reported. A quiet month is not evidence that nobody looked.

There is a deadline, and it is short. 16 CFR 609.4 requires the notice to be provided "within 48 hours of any material additions or modifications to a consumer's file". Section 609.2(h) defines electronic notification as a notice by mobile application, email or text message, and adds that where the notice itself does not tell you which specific change was made, it must link to a page that does. Section 609.2(g) requires the service to give access, following a notification, to all the information in the file at the time of the notification, which is what makes the alert actionable rather than merely alarming.

The rule anticipates being used as a sales channel and forbids it. 16 CFR 609.3(e)(1) requires that once a consumer is in the process of enrolling, any advertising or marketing of other products be delayed until after enrollment is complete, and (e)(2) prohibits communications that "interfere with, detract from, contradict, or otherwise undermine" the purpose of providing the free service. The examples given in (e)(3) are instructive about what the Commission expected: material implying that a paid product must be bought in order to get the free service, and material falsely representing an ancillary product such as identity theft insurance as free, or failing to disclose prominently that a service advertised as free for an initial period must be cancelled to avoid charges. Section 609.3(f) adds that the agency may not require the consumer to agree to any terms or conditions beyond those needed to comply with law.

Eligibility is broader than "deployed", and it lasts two years at a time. 15 USC 1681c-1(k)(1) expressly includes a member of the National Guard, and 16 CFR 609.3(c)(2) deems an agency compliant if it serves consumers who self-certify active duty status, reservists called to active duty, or National Guard membership. Under 609.3(c)(3) a verification is valid for two years, after which the agency may ask for proof again.

One limitation on this particular right is unusual and worth knowing. Under 15 USC 1681c-1(k)(4), the Fair Credit Reporting Act's civil liability provisions at 1681n and 1681o "shall not apply to any violation of this subsection", which is enforced instead "exclusively" by the federal agencies and federal and state officials identified in 1681s. So a service member who is denied the free monitoring has an enforcement route through regulators rather than a private damages claim under those sections.

For a commercial product, the contract is the specification. Everything above describes the mandated service. A paid subscription is governed by its own terms, and the questions that decide what it is worth are which of the three bureaus it watches, since a file at an unwatched bureau can change without a notification, what it counts as an event, how fast it notifies, and which score it shows. On that last point the published material on credit scores, FICO Scores and VantageScore explains why the number in a monitoring app is often not the number a lender will use. Note also that monitoring keeps working through a freeze: a file monitoring service you subscribed to is one of the statutory exceptions in 15 USC 1681c-1(i)(4), set out in the published material on credit freezes.

You enroll, prove who you are, and the service watches the file or files it covers. When something it counts as an event is recorded, it notifies you and gives you a way to see what changed. What you do next belongs to other machinery: a dispute if the item is wrong, an identity theft report and a block if it is fraudulent, a freeze if you want new accounts stopped.

A hypothetical example, using the mandated military service because it is the one with published specifications. Sergeant Adeyemi has enrolled after self-certifying active duty status. In one month, four things touch her file.

A lender pulls her report because she applied for a car loan. That is an inquiry, and it is notifiable.

A card issuer pulls her report as part of its periodic account review. That is an inquiry too, but 609.2(l)(2)(i) excludes account-review pulls, so no notice is due.

Her card issuer reduces her limit from $8,000 to $7,000. The change is $1,000, comfortably over the $100 threshold in 609.2(l)(4), so it is notifiable. Had the issuer trimmed it by $60, it would not have been.

A collection account appears. That is both a new collection account under 609.2(l)(1) and negative information under 609.2(l)(5), and it is notifiable.

Each notice that is due has to reach her within 48 hours of the change, and each must either say what changed or link to a page that does.

Pros

• It shortens the gap between something appearing in your file and you knowing about it, which is the gap identity thieves work in.
• The mandated military version is free, defined by regulation rather than by a marketing page, and carries a 48-hour notification deadline.
• A notification comes with access to the file as it stood, so you can see the item rather than only be told one exists.
• It keeps operating through a credit freeze, because a monitoring service you subscribed to is a statutory exception to the freeze.
• It costs nothing to combine with the free tools, and the two do different jobs.

Cons

• It is detection, not prevention. Nothing about a notification stops the account that triggered it from having been opened.
• Coverage is per bureau. A service watching one file is silent about changes to the other two, and you generally cannot know which file a lender will pull.
• Prescreened-offer and account-review inquiries are excluded from the mandated service, so quiet is not the same as untouched.
• Furnishers report on their own cycles, typically monthly, so an event can be weeks old before any monitoring service could see it.
• A paid product's scope is whatever its contract says, and the score it shows is frequently a different model or version from the one a lender buys.
• Several things monitoring is sold alongside are separately free: the file disclosures, and the freeze.
• The free military mandate is enforced by regulators rather than through the Act's private civil liability sections.