Identity Theft Insurance

Identity theft insurance is coverage that indemnifies a policyholder for the costs of restoring their identity and credit after it has been misused, rather than for the value of what was taken. NAIC's consumer guidance describes it as reimbursing "certain costs associated with restoring your identity, such as legal fees, lost wages, and administrative expenses", and adds that these policies "may be sold separately or included in homeowners or renters policies". The Texas Department of Insurance lists the same category of costs in more detail: "fees, phone bills, lost wages, notary and certified mailing costs, and sometimes attorney fees". The distinction that governs everything else about the product is that it insures the cleanup rather than the loss. Money taken from a bank or card account is generally the bank's or the card issuer's problem under separate consumer-protection rules, so what remains for insurance is the time and professional expense of proving to a series of institutions that the transactions were not yours.

The coverage exists because the residual exposure after federal law does its work is administrative rather than financial. The Texas Department of Insurance puts the point squarely in its own consumer guidance: "Banks and credit card companies cover most or all losses due to fraud", so most victims spend more time than money restoring their identity, and, in the same guidance, "complex cases can mean attorney's fees and lost wages if you need to take off work, which could be covered by an identity theft policy." That is the entire case for the product, stated by a regulator: the ordinary case costs hours, the unusual case costs money, and the insurance addresses the unusual case.

How it is sold matters more than what it costs, because the commonest answer is that you already have it. NAIC's guidance says the coverage may be sold separately or included in a homeowners or renters policy. The Texas department's page is more granular: "Some homeowners policies include coverage for identity theft. Check your policy or ask your agent to see if yours does. Other companies can add it to your homeowners or renter's policy or sell you a stand-alone policy. These typically cost $25-$50 a year." That premium figure is Texas's, on a page last updated in January 2023, and prices are neither uniform across states nor fixed over time.

The regulatory classification of the product has been contested, and one state's regulator worked through it in public. In OGC Opinion No. 08-03-14, issued 19 March 2008, the New York Insurance Department was asked whether New York law authorized a stand-alone identity theft policy covering restoration costs. Its conclusion was that neither the Insurance Law nor its regulations authorized such coverage "per se", though the Department had approved policies including it "as a component of other coverage (like homeowners)", and had "authorized identity theft coverage as endorsements to homeowners and motor vehicle insurance policies". The opinion also observed that the coverage "typically does not provide for loss to property, but only for incidental and remedial expenses incurred in connection with identity theft". That opinion is old, and New York's insurance regulator has since been reorganized into the Department of Financial Services, so it should not be read as a current statement of New York law. What it does show durably is why the endorsement form is so common: a contract that pays only expenses does not fit neatly into the enumerated statutory categories a state insurance code sets out.

The regulatory footprint is thin, and the absences are worth stating because they are measurable. NAIC's Glossary of Insurance Terms has no entry for identity theft insurance. Neither does the California Department of Insurance's glossary. NAIC's own Insurance Topics page for identity theft, in its 28 July 2026 revision, is almost entirely about the crime rather than the product. Its one product-side note concerns insurer reporting: in 2015 the Cybersecurity (H) Working Group, the Property and Casualty Insurance (C) Committee and the Financial Condition (E) Committee "collaborated to develop the Cybersecurity and Identity Theft Insurance Coverage Supplement for insurer financial statements", and NAIC records that "since 2024, the Cyber Supplement no longer requests data pertaining to identity theft specifically as it is largely a commercial product." The referent of "it" in that sentence is not unambiguous, and nothing here rests on a reading of it. What can be said plainly is that the national body of insurance regulators stopped collecting identity-theft-specific figures from insurers in 2024.

One boundary is worth keeping distinct. NAIC notes in a parenthetical that "identity theft insurance is different from cybersecurity insurance. Cybersecurity insurance, sometimes known as cyber insurance, is typically held by businesses." The two are sometimes discussed together because insurers report them in the same supplement, but they answer different questions: personal identity theft coverage pays an individual's recovery costs, while cyber coverage responds to an organization's liability and response costs after a breach.

A claim runs on receipts rather than on the fraud itself. The policyholder reports the theft, works through the recovery steps with the bureaus, creditors and law enforcement, and submits documented expenses to the insurer: certified mail and notarization, replacement documents, time off work at documented earnings, and legal fees where the contract allows them. The insurer applies whatever deductible and coverage limits the policy sets and reimburses the remainder. Some policies also provide a case manager to do part of the work rather than paying the policyholder to do it.

A hypothetical example of what a claim looks like. Suppose a thief opens accounts in someone's name and runs up $9,000 of fraudulent charges. The card issuers reverse the charges, so none of that $9,000 reaches the insurance claim. What does reach it is the cleanup: 40 hours away from work at $35 an hour, or $1,400; $180 of certified mailing and notarization; and $2,500 in legal fees for a disputed account that would not close. Those come to $4,080. Against a policy with a $250 deductible, the insurer reimburses $3,830. The policy's coverage limit, if lower than $4,080, would cap it further. The deductible and the hourly rate here are this hypothetical's; both are contract terms or facts about the claimant rather than market figures.

Two checks are worth doing before buying separately. Whether the homeowners or renters policy already carries the coverage, because NAIC and state regulators both describe inclusion as common. And what the policy excludes, since contracts vary on whether lost wages are covered at all, whether legal fees require the insurer's consent, and whether business-related identity theft is in or out.

Pros

• It addresses a real residual exposure: the hours and professional fees of proving that transactions were not yours, which no other consumer protection covers.
• It is frequently available as an endorsement on a policy already held, which is the cheapest way to obtain it.
• Some policies supply case-management help rather than only money, which is the scarcer resource in a complicated case.
• Claims are documented against receipts and pay stubs, so what is covered is comparatively easy to establish.

Cons

• It does not reimburse stolen money, which is what the name suggests it covers.
• The exposure it covers is small in the ordinary case, because banks and card issuers already absorb fraudulent charges.
• Duplication is easy: the same coverage is often already on a homeowners or renters policy, and sometimes bundled into a monitoring subscription.
• The regulatory material is unusually thin, so there is little independent guidance against which to judge a particular contract's exclusions.
• Deductibles, limits and the treatment of lost wages and legal fees vary widely, and the differences are only visible in the policy.