Identity Protection Services vs. the Free Freezes That Work Better

The one thing identity protection services don't do is the thing in their name. They don't protect. They monitor, they alert, and they help you clean up afterward — all of which happens after someone has already used your identity. The only tool that actually prevents the most damaging identity crime, a new account opened in your name, is the credit freeze: free at all three bureaus because federal law requires it, and quietly in direct competition with the product being advertised to you.

We've covered what to do when identity theft happens — the 48-hour containment sequence, the FTC report, the liability rules. This is the other question: what's worth paying for before it happens, and what the subscription is actually selling.

What monitoring services actually do

Strip away the marketing and a typical service bundles five things: credit monitoring (an alert when something new hits your credit files), dark-web scanning (a notice when your email, SSN, or passwords surface in breach data), identity alerts (your SSN appearing on new applications, address changes, court records), restoration services (a caseworker who helps with the cleanup if you're hit), and an insurance policy with a large number on it. Each of these is a detection or recovery tool. None of them stops anything.

That's not a technicality — it's the whole architecture. A monitoring service learns about a fraudulent account the same way you would: after it exists. The alert arrives when the damage starts, not before. Useful, sometimes. Prevention, never.

What no service can do

• Stop a thief who already has your data from trying to use it. Your SSN is very likely in multiple breach databases already — monitoring tells you it's there, which changes nothing about whether someone acts on it.
• Prevent tax-refund fraud, unemployment-benefits fraud, or medical identity theft. These crimes never touch your credit files, so credit monitoring is blind to them. The defenses that work — an IRS IP PIN, your state's unemployment fraud reporting, reading your insurance explanations of benefits — are free and outside the product entirely.
• Block a new credit account from being opened. Only a freeze does that, because only a freeze makes your credit file unreadable to the lender running the check.

The freeze: the free product the paid product competes with

Since federal law made them free in 2018, credit freezes at Equifax, Experian, and TransUnion cost nothing, don't touch your credit score, and block new-account fraud cold — a lender who can't pull your file won't open the account. When you legitimately need credit, you thaw online in minutes, then refreeze. You place one with each bureau separately and keep the PINs somewhere safe; the mechanics are in our identity-theft piece, so we won't re-tutorialize here.

Sit with the incentive problem for a second. The most damaging identity crime is preventable, for free, in about half an hour. An industry built on monthly subscriptions has no reason to lead with that, and mostly doesn't.

Alerts, freezes, and "locks" — a naming trick worth understanding

Three similar-sounding things, very different in substance. A fraud alert is a flag on your file asking lenders to verify identity before opening credit — free, but it's a request, not a wall. A freeze is the wall: your file can't be pulled at all. A "lock" is the bureaus' own app-based version of a freeze — same practical effect, but offered as a proprietary product, historically bundled into paid subscriptions, and governed by a contract rather than by the federal statute that guarantees your freeze rights.

That last one deserves to be called what it is: the bureaus took a protection Congress forced them to give away, rebuilt it with a slicker app, and sell it back. If a bureau's site nudges you toward the lock, keep scrolling until you find the freeze. Same wall, statutory rights, zero dollars.

The honest case for paying

None of this makes paid services worthless. There are four real things in the box.

• Restoration help. If you're hit hard, the cleanup is genuine labor — disputes, phone trees, certified mail, months of follow-up. A caseworker who does it with you has value. Though know that the free path, the FTC's IdentityTheft.gov recovery plan, is effective and generates the documents that make creditors comply.
• Family plans that watch children's SSNs. Child identity theft is underrated — a kid's clean, unmonitored file can be abused for years before anyone checks. A frozen file for each child is genuinely worth arranging. You can do it free yourself: each bureau has a process for placing a freeze for a minor, though it's clunky — typically a mailed form with copies of birth certificates and ID; check each bureau's site for its current requirements. A service that handles this for a family has earned some of its fee.
• Dark-web alerts as an early warning. An alert that your password surfaced in a breach is actionable — if you then rotate the password and check the freeze. The alert without the action is theater. If you'd act on it, it has value; if you'd archive the email, it doesn't.
• The nagging itself. Some people simply will not place freezes, set up alerts, or check reports without a service prompting them. If a subscription is the difference between protected and not, that's a real, if slightly embarrassing, benefit.

About that "$1 million in coverage"

Read the actual policy and the headline number deflates. The insurance is mostly expense reimbursement — notary fees, mailing costs, some legal fees, lost wages with per-day and total sublimits — not a fund that reimburses stolen money. And the stolen money usually doesn't need it: fraudulent credit card charges are capped at $50 by federal law and typically waived entirely, and debit fraud reported promptly is capped too — the liability tiers are in our identity-theft piece. The million-dollar policy mostly insures costs you were unlikely to bear, against losses the banking system already eats.

The free stack that covers most people

1. Freeze your credit at Equifax, Experian, and TransUnion. If you want to be thorough, also freeze at ChexSystems (bank accounts) and NCTUE (phone and utility accounts) — both offer freezes, though their processes are less polished; check their sites.
2. Pull your free credit reports at AnnualCreditReport.com — available weekly from all three bureaus. A calendar reminder every month or two beats any monitoring subscription's coverage of your own file.
3. Turn on transaction alerts at your bank and card issuers — a push notification for every charge. This is the single best fraud detector available at any price: you learn about a bad charge in seconds, not at month-end.
4. Use a password manager and unique passwords everywhere. Reused passwords are how one breach becomes ten account takeovers.
5. Turn on multi-factor authentication everywhere it's offered, app-based rather than text-message where you have the choice.
6. Get an IRS Identity Protection PIN at irs.gov/ippin — free, and it blocks any electronically filed return in your name that lacks the PIN.
7. Sign up for USPS Informed Delivery, so you see what mail should arrive and notice what doesn't.

One evening of setup. Total cost: roughly the price of a password manager, and free versions exist.

Before you buy: check what you already have

After major breaches, the breached company routinely offers a year or more of free credit monitoring or identity protection — sometimes longer through class-action settlements. If you've been notified of a breach, claim the free monitoring instead of buying it; terms vary by settlement, so read the notice. And many employers now include identity protection in benefits packages. Check your benefits portal before paying retail for something you may already own.

If you want a paid service anyway, price it honestly

A worked example, with hypothetical numbers. Say a plan runs $25 a month — individual plans commonly run $10–$25, and family tiers often more, which only strengthens the math that follows. That's $300 a year, $3,000 over a decade. The free stack above already blocks new-account fraud, catches card fraud in real time, and stops tax-refund fraud. So the $3,000 buys the marginal difference: restoration labor if you're hit, child-file handling you could do yourself by mail, and the convenience of one dashboard. If that's worth $300 a year to your household — and for a busy family with several kids' files to manage, it might genuinely be — buy it with clear eyes. Just don't buy it believing it prevents anything.

Red flags when you shop

• Fear-based marketing that shows you your own "exposed" data. Much of it is recycled from old breaches — alarming on screen, and often years stale. It's a sales tactic, not a live threat assessment.
• Any service is a concentration risk worth naming: to monitor your identity, it needs your SSN, birth date, and sometimes account credentials. You're handing your full identity kit to one company to watch for the consequences of companies losing your data. Ask how they store it, and prefer services that use read-only connections over ones wanting your actual banking passwords.
• Auto-renewal at a higher rate after a teaser price — check the renewal number, not the promo.
• Bureau-owned add-ons that upsell you a lock or a score product on the way to the free freeze.

The order of operations, on one screen

1. Freeze your credit at all three bureaus. This is the actual protection, and it's free.
2. Freeze your children's files too — clunky, by mail, worth it.
3. Turn on bank and card transaction alerts for every account.
4. Set up a password manager, unique passwords, and multi-factor authentication.
5. Get an IRS IP PIN and USPS Informed Delivery.
6. Check for free monitoring you already have — breach settlements, employer benefits.
7. Only then decide whether restoration help and convenience are worth a monthly fee — for some families, honestly, yes.

The industry's pitch depends on you not knowing that Congress already made the strongest protection free. Build the free stack first. If there's anything left you still want — a caseworker on standby, one app for the whole family — pay for that, on purpose, at its real price. Just never pay for the word "protection" doing work the product doesn't.