Identity theft protection services are bought in a hurry, usually straight after a breach letter, and most buyers cannot tell what they are paying for. The same label covers credit monitoring, wider identity and dark web monitoring, restoration help from case managers, and insurance with exclusions that matter. Some of the most effective protections, such as credit freezes and fraud alerts, are free. This vendor-neutral buyer's guide is for three groups: individuals choosing a plan, HR and benefits teams offering protection as an employee benefit, and incident response and legal teams selecting a service to offer people affected by a breach. It focuses on the US market, where these services are most common. For the free steps, see the Credit Freezes and Fraud Alerts Guide; if theft has already happened, start with the Identity Theft Recovery Guide.
Key takeaways
- Monitoring detects, it does not prevent. Credit monitoring tells you after a new account appears. A credit freeze, which the FTC says costs nothing to place or lift, stops most new credit accounts from being opened at all.
- Know the blind spots. The FTC notes credit monitoring will not alert you to bank account withdrawals or a tax return filed with your Social Security number, and identity monitoring typically will not flag fraudulent tax refunds or benefit claims.
- Restoration is the valuable part. Case managers who do the paperwork, and can act for you with formal authority, save the most time after a real theft.
- Read the insurance terms. Identity theft insurance generally does not repay money a criminal stole, and many policies will not pay where homeowner's or renter's insurance already covers the loss.
- Employers and breach responders buy differently. Enrolment rates, coverage of family members, data handling and contract terms matter more than the feature list.
Define requirements
- Who is covered: one adult, a household, children, older relatives, or a workforce or breach population of thousands. Child identity theft can go unnoticed for years; see the Child Identity Theft Guide.
- What was exposed: for a breach offer, match the service to the data lost. Social Security numbers point to credit and tax risk; health data to medical identity theft; passwords to account takeover; phone numbers to SIM swap fraud.
- Free baseline first: confirm what is already available without paying: credit freezes at all three nationwide bureaus, a free one-year fraud alert placed with one bureau that must notify the other two, free credit reports through AnnualCreditReport.com (weekly, according to the FTC), and the free recovery plan at IdentityTheft.gov.
- Duration: how long monitoring must run. Breach offers often have a fixed term, and some US state breach notification laws set a minimum period when Social Security numbers are exposed; check the laws that apply to your affected population.
- Budget and model: per person per month, per enrolled person, or a flat breach population fee, and whether unused codes are charged.
Capability areas
| Capability | What it does | What to check | What it will not do |
|---|---|---|---|
| Credit monitoring | Alerts on changes to credit reports, such as new accounts, late payments or lawsuits | One, two or all three bureaus; how often reports are checked; alert speed | Bank withdrawals, tax refund fraud, accounts that never touch a credit report |
| Identity monitoring | Searches change of address records, court records, social media and sites where criminals trade data | Which sources, how often; what is a real alert versus noise | Fraudulent tax refunds; Medicare, Medicaid, Social Security or unemployment claims (FTC) |
| Dark web monitoring | Matches your email addresses, phone numbers, card and ID numbers against leaked data sets | Coverage claims; what you are told to do after a match | Remove data once leaked; it shows exposure, not misuse |
| Identity restoration | Counsellors or case managers help with letters, freezes and paperwork; some act for you under formal authority | Fully managed or advice only; covers pre-existing theft or not; family members | Undo losses on its own; it works through creditors and agencies |
| Identity theft insurance | Reimburses costs such as copying, postage, notarisation, lost wages and legal fees | Deductible, limits, exclusions, overlap with home or renter's insurance | Generally does not repay stolen funds (FTC) |
| Freeze and lock tools | Help place or manage freezes and locks | Whether it uses a statutory freeze or a contractual lock; all three bureaus | Replace a freeze you control yourself |
Evaluation criteria
| Criterion | Individual buyer | Employer benefit or breach offer | Suggested weight |
|---|---|---|---|
| Restoration quality | Fully managed case work with a named contact | Restoration available to all enrolled, including pre-existing issues; service levels for response | 25% |
| Monitoring coverage | All three bureaus; sources listed for identity monitoring | Same, plus monitoring matched to the data actually exposed | 20% |
| Insurance terms | Deductible, limits and exclusions in writing | Master policy terms; who the insurer is; claim process | 10% |
| Ease of enrolment | Simple sign-up, clear cancellation | Activation codes, call centre capacity, languages, accessibility; enrolment rate reporting | 15% |
| Data protection | What personal data is collected and shared, marketing use | Data processing terms, retention, no upselling to the affected population without consent, security attestation | 15% |
| Price and terms | Monthly price after any introductory period; auto renewal | Price model, minimums, term length, renewal at the end of a breach offer | 15% |
For breach offers, the service is part of your notification, so its call centre is speaking for you. Check scripts, escalation to your own team and complaint handling. The Data Breach Notification Checklist covers the notification obligations around the offer. A service that collects Social Security numbers, account numbers and identity documents to monitor them is itself a high-value target: ask how that data is protected and who inside the provider can see it. For an employee benefit, also decide whether cover continues after someone leaves, whether it is portable at the employee's own cost, and how the benefit interacts with any service already offered after a past breach, so people are not enrolled twice or left with a gap.
Questions to ask vendors
- How often do you check credit reports, and which of the three bureaus do you monitor?
- Is there a limit on how often I can review my reports, and am I charged each time?
- Exactly which sources does identity and dark web monitoring search, and how often?
- Is restoration fully managed, and can a case manager act on my behalf with a limited power of attorney? Does it cover theft that began before enrolment?
- What are the insurance limits, deductible and exclusions, and who underwrites the policy?
- For employers and breach offers: what enrolment rates do you typically see, how do you report them, and how do you handle family members and former employees?
- Will you market paid upgrades to people enrolled through our breach offer, and can we prohibit it?
- What happens to enrolled people's data when the term ends?
Red flags
- Claims to "prevent" or "guarantee" protection against identity theft; monitoring cannot do either.
- Large insurance headline figures with no deductible, limits or exclusions shown.
- Pressure to buy a paid service instead of placing a free credit freeze.
- Monitoring of only one credit bureau sold as complete credit monitoring.
- Low introductory prices that auto renew at a higher rate without clear notice.
- Breach offers where enrolment requires accepting marketing or sharing data with partners.
Proof of concept
- Place free credit freezes and review free credit reports first, so the paid service is judged on what it adds.
- For an employer or breach programme, enrol a pilot group and measure activation time, call wait times and enrolment rate.
- Trigger a test alert, for example a change of address or a new email added to monitoring, and time the notification.
- Call restoration with a realistic scenario and judge whether they take on the work or only give advice.
- Obtain the full insurance policy, not the summary, and have it checked against existing home or renter's cover.
- Review the data processing terms, cancellation path and end of term process before signing.
How NHI Mgmt Group can help
We provide independent identity security and breach response advisory, including evaluating protection services offered to employees and affected individuals. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Credit Freezes and Fraud Alerts Guide · Identity Theft Recovery Guide · Dark Web Exposure Guide for Individuals · Tax Identity Theft and Tax Scams Guide · Synthetic Identity Fraud Guide