NEW YORK (MONEY Magazine) - At least that's what John Gardner, a smooth-talking lawyer and spokesman for a company called Pre-Paid Legal Services, would have you believe.
Here's his scenario. A bad guy steals your identity. He ends up in the hospital and pretends to be you. His medical history becomes a part of what Gardner calls your "MIB identity, or Medical Information Bureau identity." You could end up being denied insurance -- or much, much worse.
"It could cost you your life," says Gardner, whose résumé includes eight years as a South Carolina legislator as well as co-authorship of "Chicken Soup for the Entrepreneur's Soul." "If you show up on the medical bureau as having heart disease or diabetes and then show up at the hospital unconscious, they might kill you trying to save you."
Goodness. So, as they say on late-night TV, how much would you pay to defend against those diabetic doppelgängers? Pre-Paid Legal's core credit monitoring service runs $13 a month, or $24 to $35 a month if you throw in its various legal services, which Gardner says you'll certainly need to get the most ID fraud protection. Considering the risks, what's $420 a year for a little peace of mind?
A lot, actually. As you've read these past few months, identity theft is becoming a huge problem, netting more than $50 billion annually for the crooks and leaving the victims with no end of headaches. With enough information about you, a criminal can get credit cards, cell phones, apartments and, yes, even medical care in your name, leaving you to deal with the collectors and credit bureaus when the perp skips on the bills.
Not surprisingly, financial companies, including big names like American Express, Chase, Citi, Discover and MBNA, see opportunities in the hysteria over this, and they're hawking services designed to protect you from the threat. A few of them might be useful for some folks.
But before you shell out one thin dime, take a deep breath and try to understand what the real risks are -- and what's just lurid hype.
Don't believe the hype
File Gardner's death tale in the hype box. Medical records aren't nearly as centralized as he makes it sound.
What about those MIB files? They exist, but only a fraction of Americans have one, and more important, they're used by insurers to detect omissions and fraud in insurance applications. An MIB report isn't accessed by doctors or other medical practitioners. Besides, you can review it yourself, and it's free: Call 866-692-6901.
We'll take a closer look at how credit protection services work and who might need them -- and who doesn't.
But there's a bigger issue here: Why on earth should you have to pay for any of this? Privacy advocates complain that ID protection is often sold by the very companies that have contributed to the problem. "If the credit industry were doing a better job protecting you, we wouldn't need such products," says Beth Givens of the Privacy Rights Clearinghouse in San Diego. Lawmakers could -- heck, should -- render these overpriced services obsolete.
Safety for sale
Banks, credit-card companies and data brokers are pushing two basic kinds of identity protection: insurance plans that reimburse you for some out-of-pocket expenses from theft, and credit monitoring services that alert you when certain new information about you pops up at one of the three major credit bureaus. There are also sexed-up versions of monitoring that can come with all sorts of frills. (Click here to see "Who Needs This Stuff?")
You can spend hours clicking through different Web site offers and promotions just trying to figure out which products are being sold at what prices (from $25 to $155 a year or more) and what all these things are supposed to accomplish.
It doesn't help that credit bureaus peddle the same services through a bewildering variety of sites with misleading names like Freecreditreport.com (that's Experian), Freecreditprofile.com (that's TransUnion) or Free-credit-report-in-seconds.com (Experian again).
And unfortunately, there's so little hard data out there about ID theft that one can't be certain which protection services help and which are overkill. Still, there are facts that help put the risk in perspective. Once you've seen them, you may be less anxious to shell out.
Your real threat
An American Express telemarketer might tell you that one in four U.S. households has been a victim of ID theft. The Web site for Equifax puts the number at around 10 million Americans a year, which works out to more than 4 percent of adults.
These numbers must be based on a very broad definition of identity theft. According to Javelin Strategy & Research, most ID cases are basic credit-card fraud: Someone steals your card or your number and goes shopping. Report such frauds promptly and it's typically a nuisance at worst: The law limits your costs to $50, and the major card networks offer zero liability.
Another slice of the ID theft pie involves non-credit-card fraud, like someone tapping your bank account. That's frightening, but credit monitoring can't detect most of this. You detect it by watching your accounts regularly.
The kind of identity theft that's most dangerous is called new-accounts fraud. That's when someone actually gets credit cards and other accounts in your name, sullying your credit report as they go. In a year, this happens to a tad fewer than one out of 100 people.
That's still millions. But most of them end up on the hook for little or none of that debt. Indeed, less than 20 percent of new-account victims surveyed in 2004 reported out-of-pocket financial losses greater than $500.
Why is that small group hit so hard? Javelin's research suggests that many nightmare cases aren't random crimes pulled off by some hacker who plucked your name from a Web site. Instead, the victim often knows or is even related to the criminal.
That's why it may take you longer to discover the crime: The imposter knows your habits. And some victims may be reluctant to involve the police, which in the end can make it harder to get out of paying those bills.
As Javelin's James Van Dyke puts it, "Who wants to send a sobbing friend or family member to jail?"
The point is, some people are at greater risk than others. Think about your own life -- maybe you have a close family member with a drug habit or pressing financial problems -- and you probably have a good sense of where you fall along that spectrum.
Adding it all up
Even if you don't lose much money to an ID thief, fixing your record can be a costly chore. Although 20 percent of new-account frauds are cleared up in less than an hour, reports Javelin, an equal number can take 80 hours or more to resolve. Sometimes much longer.
"I've talked with victims who've logged 500 hours," says Givens.
But there are limits on what most ID protection services can do to soften the blow. Although insurers will pay for some lost work time, they typically cap payouts at $500 a week for four weeks.
Many services offer some kind of telephone counseling, which can be helpful if you're in full panic mode, but much of the advice they give is available free on the Federal Trade Commission's excellent Web site, Consumer.gov. Only a few services claim to do a lot of serious legwork on your behalf (you may have to sign a limited power of attorney), and they tend to be the more expensive ones.
Clearly, what you want to focus on is prevention -- or at least discovery of a theft before it gets out of hand.
The good news is there's a lot you can do that's cheap or free. Guard your Social Security number jealously. Read and pay your bills online. Check your credit report at least once every four months by getting the free report you're entitled to once a year from each of the big three reporting agencies. And if you think you've been a victim, place a free 90-day fraud alert with one bureau, which must then notify the others.
None of this is 100 percent protection -- no such thing in our data-drenched world. Yet credit monitoring services say they can close the gap.
This is true. But by how much? And what's that worth? Over an adult lifetime, a deluxe monitoring service that watches all three bureaus may cost you more than $9,000 in today's dollars. Is that heightened level of safety really worth six times the $1,500 you'd pay for a no-frills single-bureau monitoring service? Probably not.
Privacy advocate Givens (who thinks more about the problem of ID theft than just about anybody you'll ever meet) says she makes do with reading her free reports every four months.
Living with risk
Once you've taken sensible precautions to protect your data, your need for credit monitoring depends on facts about you, not national statistics. Victims of robbery, burglary or previous ID theft obviously might benefit more from credit monitoring.
You also might want to be extra vigilant if you own a small business and need frequent access to credit or if you are heavily involved in real estate investing. In those cases, being wrongly rejected for a loan could be costly.
Your decision really turns on how much uncertainty you're willing to live with.
"It has less to do with the probability of it happening and more to do with the feeling of being violated," concedes Equifax executive Vince Corica.
It's emotional, in other words. And understanding how your emotions drive your thinking about risk may help you to make a clearer decision. Howard Kunreuther, an expert on insurance at Wharton, notes that people are usually willing to pay a premium to protect themselves against the dangers that seem most vivid -- perhaps because they've seen and heard a lot about them. (Sound familiar?)
But there are plenty of risks that get less attention yet are actually more serious. If you want to spend money to feel safer in life generally, you may benefit far more from, say, long-term-disability insurance. And yet most people have too little of it.
Warning: Irony ahead
When it comes to ID theft, it's hard to escape the feeling that you're getting pinched coming and going. As we detailed recently, one reason we're all so vulnerable now is that the data and financial services industries have fought laws that would give you more control over how your data are used. And the banks and the credit bureaus could do a lot more to spot and thwart imposters.
Certainly it's a bit, shall we say, poignant that many of the card issuers stuffing your mailbox with the junk mail you're supposed to shred are also marketing ID protection.
The data industry has lobbied to defeat state laws that allow you to slap a freeze on your report for a small fee. With a freeze, no potential lender can order your credit information unless you first contact the agencies and tell them to unlock your report. The idea is to make it nearly impossible for someone else to borrow money in your name.
"Credit monitoring can't prevent ID theft," says Chris Hoofnagle of the Electronic Privacy Information Center. "The thing that is worth paying for is the security freeze."
Freeze laws have been passed in 10 states, including California, Colorado, Illinois and Texas, although in many states they are available only to people who have already been victims of fraud. Credit agencies have opposed this idea on the grounds that consumers would hate the inconvenience.
But if ID theft is as dangerous as these companies say -- Equifax CEO Thomas Chapman has written that relying on just one free credit report a year is like turning on your fire alarm only on weekends -- perhaps we are at least entitled to a choice between the inconvenience of a freeze and paying as much as $155 a year for monitoring.
Privacy expert Daniel Solove of George Washington University goes even further: Credit agencies should be required to inform people about inquiries into their credit. The law already says agencies must do their best to ensure "maximum possible accuracy" in their reports, Solove says, adding, "Why should credit agencies be selling the consumer something that helps the consumer ensure they are being accurate?"
Equifax's Corica responds that it's hardly the credit agency's fault if a lender hands over money to a determined fraudster. "The perpetrator here is not American industry. It's the criminal."
Fair enough. Yet the data explosion can make criminals' activities a lot more damaging to you and me. In a truly scary form of ID fraud, a thief might give your name when arrested for another crime. Worst case, you mistakenly end up in jail after a traffic violation. Second worst: Your false criminal record is added to the profile about you that's sold by the many data brokers that compile such public information.
A company called Intersections will soon offer monitoring that gathers details on you in the LexisNexis public records database, which lists everything from property purchases to professional licenses. Now, LexisNexis is one of the companies that revealed a huge ID security breach earlier this year -- a bungle that in its case involved up to 310,000 files.
"If the criminals want that data, then I want to monitor that data," says Intersections CEO Michael Stanfield.
It's a clever idea. But it prompts a question: If you're entitled to free and easy access to your credit report, shouldn't the same be true for all the other for-profit databases out there? A bill currently wending its way through the Senate would at least require disclosure from data brokers at a "reasonable" cost.
We'd like to suggest a reasonable number to the Senate: zero, zilch, zippo. It's your data, after all; these guys just figured out how to sell it.