Identity Theft Insurance – Miserly Upon Misery

This report examines the nascent identity theft insurance market and related consumer service of “credit monitoring”. The report concludes that the present product offerings of both identity theft insurance and credit monitoring are flawed in that a major component of each is already provided free to consumers who are aware of it. Identity theft insurance coverage of credit or debit card losses is superfluous in most cases given the existence of zero liability policies of major credit card issuers and because debit card losses in most cases are reimbursed under a voluntary bank debit card code. Credit monitoring has as its core feature the delivery of a credit report from a major credit reporting agency, however, consumers in all provinces have a right to access these reports upon request at least once a year at no cost. The report calls for provincial insurance regulators to ensure that companies offering identity theft insurance are required to disclose that there are these free services that overlap with the intended coverage or service. Identity theft coverage as it now stands is also of questionable value, given that its major potential claims items, that is, payment for time off work to resolve identity theft issues, as well as legal assistance, are capped at low recovery levels. Uncertainty over the extent of “legal assistance” under these agreements abounds, and it is noted that most identity theft victims do not actually need full legal defence services to recover from identity theft. Both credit monitoring and identity theft insurance may have a dampening effect upon efforts by consumers to directly attack the problem of identity theft. Both products shift costs of identity theft to consumers from business. Credit monitoring also has been used as an inadequate form of recompense to consumers after a corporate data breach. Instead, governments should consider the effectiveness of data breach disclosure laws and consumer credit freezes. The report notes that corporations may be the real parties in need of identity theft insurance, in the form of data breach insurance, and that such insurance might encourage corporations to institute best practices for information handling. Concerns also emerge with credit monitoring and identity theft being another service provider that collects and relies upon sensitive consumer information. Therefore these services could be themselves targets of identity theft attempts. Providers of these services must provide an extremely high standard of data security to safeguard the vulnerable consumers who do seek their services. The report closes with a recommendation that identity theft insurance increase coverage of actual fraud losses and the consumers think carefully before purchasing these services in their present state.