Identity Monitoring

Identity monitoring is a service that checks databases outside the credit reporting system for new or inaccurate information associated with you, and notifies you when it finds some. The Federal Trade Commission describes it as companies that "check databases that collect different types of information to see if they contain new or inaccurate information about you, including things that might not show up on your credit report."

It is worth naming carefully, because the phrase most people search for is not the name of the product. The FTC groups consumer identity products into four categories: credit monitoring, identity monitoring, identity recovery services and identity theft insurance. Dark web monitoring is not a fifth category. It is one item on the FTC's list of what an identity monitoring service may alert you to, described there as information showing up "on websites that identity thieves use to trade stolen information." A subscription sold on the strength of dark web scanning is an identity monitoring subscription with one of its features in the advertisement.

The distinction from credit monitoring is which file is being watched. Credit monitoring watches your credit report and reports changes to it, and our page on it sets out what those changes are and the one case where federal law requires the service free. Identity monitoring looks in other places: public records, application databases, marketing and telecommunications records, social media, and the marketplaces where stolen data is traded. Neither prevents anything. Both report events that have already happened.

What it actually watches, in the FTC's own list. Identity monitoring services may tell you when your information shows up in a change of address request; in court or arrest records; in orders for new utility, cable or wireless services; in an application for a payday loan; in a request to cash a check; on social media; and on websites that identity thieves use to trade stolen information.

That list rewards reading twice, because it explains the product's real value and its real limit at once. Several of those events are genuinely early: a change of address request, a utility account and a payday loan application are all things someone does with your identity before they get anywhere near your credit file, and a credit report would not show any of them. So identity monitoring covers a category of harm credit monitoring structurally cannot. Equally, every item on the list is a detection after the fact. Nothing on it is prevented by the service noticing it.

The second list is the one worth reading before buying. The FTC also publishes what these services will miss: "Most identity monitoring services won't alert you if someone uses your information to file a tax return and collect your refund, get Medicare benefits, get Medicaid benefits, get welfare benefits, claim Social Security benefits, or claim unemployment benefits."

Five of those six are claims on government benefits and the sixth is a fraudulent tax return. Those are among the frauds a person is least likely to discover on their own, because nothing about them shows up in a household's ordinary paperwork until a return is rejected or a benefit fails to arrive. A household deciding whether to pay for this should know that the harms it is most afraid of, someone else collecting its refund or its benefits, sit largely outside what the FTC says the product covers.

A structural blind spot the FTC's lists do not address either way. The service looks for "new or inaccurate information about you", which presupposes that the information is filed under you. A fabricated identity built on a real Social Security number but a different name and date of birth is, by construction, a different person in the records. Whether any given service surfaces that is a question for the vendor rather than something the FTC's guidance answers, and it is worth asking directly if that is the risk you are buying against. Our page on synthetic identity fraud explains why that case is so hard to see.

What it is not, since the four products are routinely bundled and routinely confused. It is not identity recovery, which the FTC describes as access to counselors or case managers who help write letters to creditors, place a freeze and work through documents. It is not identity theft insurance, which reimburses the cost of cleaning up rather than the money taken, and which has its own page here. And it is not a credit freeze, which is the only one of these that actually prevents rather than detects, is free, and does not expire on its own.

The first question is whether you are already paying for it. The FTC notes that you might pay a company for one or get it "through your bank or credit union, credit card provider, employer's benefits program, or insurance company", and free monitoring is usually offered with a breach notice. A subscription bought in response to a breach notice frequently duplicates one the same household already holds.

The service works by subscription to data rather than by watching you.

1. You supply identifiers to be watched: a Social Security number, a date of birth, addresses, email addresses, phone numbers, and often card and account numbers.
2. Those identifiers are matched against the data sources the vendor has access to, which is where the products differ from one another and where the contract, rather than any statute, decides what you get.
3. A match produces an alert, which tells you an event has occurred.
4. You act on it, which is the part the subscription does not do. The response to a genuine alert is a freeze, a fraud alert, a call to the institution involved, and where accounts were opened, the identity theft report our page on identity theft describes.

A hypothetical example, and the comparison is the point rather than the amounts. A household is offered identity monitoring at $19.99 a month, which is $239.88 a year (12 x $19.99). Set against that, freezing credit files at each of the three nationwide bureaus is free, does not expire on its own, and prevents new accounts rather than reporting them.

The two do different jobs, so this is not an argument that one replaces the other. It is an argument about sequence. The free control that stops the commonest harm goes first; the paid control that reports other harms after they happen is a second decision, made knowing that the FTC's own list says most such services will not catch a fraudulent tax return or a claim on Medicare, Medicaid, welfare, Social Security or unemployment benefits. If the household's specific fear is one of those six, the $239.88 is not buying protection against it.

Pros

• It reaches events a credit report never shows: a change of address request, utility, cable or wireless orders, a payday loan application, a request to cash a check, court and arrest records, and stolen data appearing in the marketplaces vendors advertise as dark web scanning.
• Some of those events are genuinely early, occurring before anything reaches a credit file, which is the strongest argument for the product.
• It requires nothing of the subscriber once configured, which suits a household that will not check anything manually.
• It may already be available at no extra cost through a bank, credit union, card provider, employer benefits program or insurer, and free monitoring is usually offered with a breach notice.
• Alerts arrive with enough specificity to act on, which shortens the gap between a fraud starting and a freeze going on.

Cons

• It detects rather than prevents. Every alert describes something that has already happened.
• The FTC's own list of what most of these services will not catch runs to six items, five of them government-benefit claims and the sixth a fraudulent tax return, which is much of what people buy the product fearing.
• What any particular service covers is set by its contract rather than by statute, so two subscriptions at the same price can watch materially different things.
• A fabricated identity built on your Social Security number under a different name is filed as a different person, and whether a service surfaces that is a question for the vendor.
• It duplicates protections that are free, in particular the credit freeze, which prevents the harm this product reports.
• Bundling makes comparison difficult, since monitoring, recovery services and insurance are sold together and the marketing rarely separates them.