Is Identity Theft Protection Worth Paying For? What Federal Law Already Gives You

The offer tends to arrive right after a breach notice, or a week later, with a countdown on the page. For a monthly fee you get monitoring, restoration help, and a reimbursement benefit. The question the page does not answer is the one that decides the purchase: what does this add to what federal law already requires someone to hand you at no charge?

Seven items in the table below are already free, and each comes with a deadline the statute sets rather than the vendor. A freeze placed in one business day. A report delivered in fifteen days. An alert that lasts a year without renewal. A fraudulent entry removed in four business days. If the subscription’s protection is a lock on your file, you already own the lock.

What is actually being sold?

It is not a legal category. The Fair Credit Reporting Act defines consumer report, consumer reporting agency, fraud alert, security freeze and identity theft report. It does not define identity theft protection, and no federal statute sets out what a monitoring subscription must do. What arrives in the box is three different things that fail in three different ways:

• Monitoring is a notification service reading a file. It reports change after the fact.
• Restoration is labor — someone else assembling the affidavits, letters and phone calls.
• The reimbursement benefit is a separate contract. Its terms, not the advertisement, decide what it pays, and this article surveys no plan forms.

So the honest comparison is not product against product. It is the bundle against the list below, each line of which carries a clock.

What does the statute give you, and on what clock?

Right	Authority	Cost	Deadline the statute sets
Your file, once per 12 months	§ 1681j(a)(1)(A)	Free	Delivered within 15 days of the request (§ 1681j(a)(2))
A freeze at each nationwide agency	§ 1681c–1(i)(2)(A)	Free	Placed in 1 business day by phone or secure electronic request, 3 by mail
Lifting that freeze when you want credit	§ 1681c–1(i)(3)(C)	Free	1 hour by phone or electronic request, 3 business days by mail
A one-year fraud alert, on request with proof of identity	§ 1681c–1(a)(1)(A)	Free	Not less than 1 year, with free file copies in 3 business days (§ 1681c–1(a)(2)(B))
A seven-year alert, with an identity theft report	§ 1681c–1(b)(1)(A)	Free	7 years, plus 5 years off prescreened offer lists (§ 1681c–1(b)(1)(B))
Blocking entries that came from the theft	§ 1681c–2(a)	Free	4 business days after the agency has all four items
A reinvestigation of a dispute	§ 1681i(a)(1)(A)	Free	30 days, extendable by 15 (§ 1681i(a)(1)(B))

None of that is a favor. The freeze carries its own command: placement and removal must be “free of charge” (§ 1681c–1(i)(2)(A), (i)(3)(C)). For the notifications and disclosures in the table, § 1681j(e) supplies the general rule — a consumer reporting agency may not impose any charge for a notification or disclosure the subchapter requires, except as subsection (f) allows. And (f) allows a fee only for requests outside subsections (a) through (d), capped at $8 by statute with an annual inflation adjustment (§ 1681j(f)(1)(A)(i), (f)(2)); the Bureau sets the current maximum under 12 C.F.R. § 1022.141. If you are being charged for a freeze, the charge contradicts § 1681c–1(i)(2)(A); for an alert or your annual file, it is barred by § 1681j(e).

Three of the free items are conditional, and the conditions are worth knowing before you pay for what they cover. The one-year alert requires you to assert a good-faith suspicion that you have been or are about to become a victim of fraud, and to provide appropriate proof of identity (§ 1681c–1(a)(1)). A free report beyond the annual one comes if you received an adverse-action notice under § 1681m — a credit denial, for example — and ask within 60 days, or if you certify, once in any 12-month period, that you are unemployed and intend to apply for work within 60 days, that you receive public assistance, or that you believe the file contains inaccurate information due to fraud (§ 1681j(b)–(c)). The seven-year alert requires an identity theft report — a copy of an official report filed with a law enforcement agency (§ 1681c–1(b)(1), 12 C.F.R. § 1022.3(i)(1)(ii)).

What does the freeze not stop?

Ten things, listed in § 1681c–1(i)(4), and the list is where the disappointment lives. A freeze does not apply to:

• a company you already have or had an account with, reviewing or collecting that account;
• a federal, state or local agency, law enforcement agency, trial court or collection agency acting under a court order, warrant or subpoena;
• a child support agency acting under part D of title IV of the Social Security Act;
• a federal agency, or a state or its agents or assigns, investigating fraud, collecting delinquent taxes or unpaid court orders, or carrying out any other statutory responsibility consistent with a permissible purpose under § 1681b;
• a person using the information for the purposes described in § 1681b(c) — prescreened credit and insurance offers;
• a person administering a credit file monitoring subscription you bought;
• a person furnishing you your own report or score at your request;
• a person using the information in connection with insurance underwriting;
• a person using it for employment, tenant or background screening;
• a person assessing, verifying or authenticating identity for a purpose other than granting credit, or investigating or preventing actual or potential fraud.

Two entries deserve a second look. The prescreened-offer carve-out means a freeze will not thin your mailbox; the extended fraud alert will, for five years (§ 1681c–1(b)(1)(B)) — a concrete thing the alert does that the freeze does not, and a reason the two are complements rather than alternatives. The three tools are compared on their own terms here.

The other entry is the employment and tenant screening carve-out, which is worth reading next to the freeze’s scope. The federal freeze duty runs against agencies described in § 1681a(p) — those that compile and maintain files on consumers on a nationwide basis — because § 1681c–1(i)(1)(A) defines the term that way for the freeze provision. What reaches specialty agencies, such as tenant screening or check verification files, is a question of state law, and that varies by state.

What does monitoring see that the lock cannot?

Nothing new in your credit file, and nothing at all outside it. A monitoring subscription watches the same reports a freeze controls. It tells you a new account appeared; the freeze is what keeps the account from appearing. Past that, its coverage stops where the credit reporting system stops.

The clearest example is tax. A return filed with your Social Security number goes to the IRS, not through a bureau, so no credit product will show it. The IRS’s own control is the identity protection PIN: six digits known only to you and the agency, valid for one calendar year, with a new one generated each year. Anyone with an SSN or ITIN who can verify identity is eligible, and a parent or guardian can request one for a dependent. It must be used on any federal return filed during the year, including prior-year returns, and a missing or incorrect PIN means an e-filed return is rejected or a paper return is delayed until the agency verifies it. If you enrolled online, you retrieve the PIN from your account each year rather than receiving a notice in the mail.

That is the shape of the whole category. The durable protections are credentials the agency issues and rights the statute enforces; the subscription sells notification and paperwork.

How do you tell whether the offer is the one the advertising rule targets?

Section 1681j(g) regulates the words. Any advertisement for a free credit report, in any medium, must prominently disclose that free reports are available under federal law at AnnualCreditReport.com (§ 1681j(g)(1)). In a broadcast advertisement the required line is blunter: “This is not the free credit report provided for by Federal law” (§ 1681j(g)(2)).

The implementing rule is 12 C.F.R. § 1022.138, and its definition is the part that reaches a modern signup page: a free credit report includes one represented, “either expressly or impliedly,” as available at no cost “if the consumer purchases a product or service, or agrees to purchase a product or service subject to cancellation” (§ 1022.138(a)(2)). A trial that converts into a subscription is inside that definition.

For a website, the rule is specific enough to check in about ten seconds. Every page that mentions a free credit report, and every page of the ordering process, must show a boxed disclosure at the top containing three things: the header “THIS NOTICE IS REQUIRED BY LAW. Read more at consumerfinance.gov/learnmore.”; the line naming AnnualCreditReport.com and (877) 322-8228 as “the ONLY authorized source under Federal law”; and a centered button reading “Take me to the authorized source” (§ 1022.138(b)(4)(i), (ii), (v)).

The limit of the rule matters as much as its content: it governs advertising that offers a free credit report. An offer that does not represent one, expressly or impliedly, is outside it, and the missing box proves nothing. But a page that says “free credit report” and carries no such box is missing something the rule requires.

If your Social Security number is already out, what is the order?

Six steps, cheapest first. The full first-72-hours walkthrough by data type is here.

1. Freeze all three files. Phone or online, free, one business day, and keep the PINs the agencies issue — you will need them to lift it later.
2. If you have evidence of misuse, file a report. An identity theft report is a copy of an official report filed with a federal, state or local law enforcement agency (12 C.F.R. § 1022.3(i)(1)(ii)). The Bureau’s Identity Theft Affidavit, and the Federal Trade Commission’s version of that form, “remain valid and sufficient for this purpose” (§ 1022.3(i)(3)(ii)) — but read what that purpose is: the rule is addressing an agency’s request for details the police report left out, so the affidavit supplies information rather than replacing the report. File the police report.
3. Then place the extended alert. Seven years, five years off prescreened lists, and two free file disclosures during the following twelve months (§ 1681c–1(b)(1)–(2)). This is the step most people skip, and it is the one a monitoring subscription cannot do for you.
4. Get the IP PIN. It is the only control in this list that covers a fraudulent tax return.
5. Block what the theft created. Four business days after the agency has your proof of identity, a copy of the identity theft report, the specific items, and your statement that they are not your transactions (§ 1681c–2(a)).
6. Dispute the rest, in writing. Thirty days, extendable by fifteen (§ 1681i(a)(1)). If an agency will not fix a file, the federal complaint route puts the dispute in front of its regulator rather than its customer service line.

When does paying make sense?

Three conditions, and they are about the parts of the bundle that are not the lock.

You want the labor. Restoration work is real work: affidavits, letters, calls, follow-up. Buying someone to do it is a service purchase, like paying an accountant, and it should be priced that way — against the hours it would take you, not against the fear of the loss.

You have read the reimbursement terms. The benefit is a contract, and the contract says what it pays. Read the exclusions and the per-incident limits before you read the marketing page.

Someone else is paying. An employer benefit or a bundle you already own changes the arithmetic completely, because the marginal cost is zero.

What does not make sense is paying for it before you have frozen the three files. The freeze is free, it takes minutes, and it is the only item in this category that keeps a lender who pulls your file from opening a credit account, rather than telling you afterward.

What if the pitch is credit repair?

Then different rules apply, and they are stricter. A “credit repair organization” is anyone who uses any instrumentality of interstate commerce or the mails to sell, provide or represent they can perform a service for money for the express or implied purpose of improving a consumer’s credit record, credit history or credit rating, or of providing advice or assistance with such a service, with narrow exclusions for 501(c)(3) nonprofits, a creditor restructuring its own debt, and depository institutions and credit unions (15 U.S.C. § 1679a(3)).

Two consequences follow. Such an organization may not charge or receive money for a service before the service is fully performed (§ 1679b(b)) — which rules out the upfront fee. And you may cancel the contract without penalty until midnight of the third business day after signing (§ 1679e(a)), with a duplicate cancellation form attached to the contract (§ 1679e(b)).

Whether a particular seller is one turns on what it promised to do, not on what it calls itself. A monitoring subscription is not credit repair; a promise to remove accurate negatives from your file is. State law can impose its own requirements on businesses that sell credit services, and those vary by state.

The decision

Buy the subscription if you want the paperwork done for you, you have read what the reimbursement benefit actually pays, or someone else is covering it. Skip it if what you want is protection, because the protection is a freeze you can place today for nothing, an alert that lasts a year without a renewal, and a report you are entitled to every twelve months.

The order that costs nothing and covers the most: freeze the three files, request the annual reports, add the IP PIN, and keep the freeze PINs somewhere you will find them in five years when you apply for a mortgage. Then decide whether the rest is worth a monthly fee — with the lock already on.

This article describes federal statutes and regulations. It is not legal advice about your file, and the deadlines above are the ones the cited provisions set; procedures at each agency differ in practice.