COLUMBIA — A credit monitoring service offered to taxpayers after a massive security breach at South Carolina's tax collection agency will not prevent account fraud, nor will it alert victims to all types of identity theft.
The service will help victims discover more quickly when new credit accounts are fraudulently opened in their name. But consumer advocates say residents must be proactive, even after signing up for the Experian service.
Since announcing the exposure of 3.6 million individual tax returns and up to 657,000 business records, Gov. Nikki Haley has repeatedly urged residents to sign up for ProtectMyID. The program provides daily monitoring of all three credit bureaus for the next year and lifetime over-the-phone help in resolving identity theft after it happens.
Haley said Thursday she wished she had such help through the process when her identity was stolen years ago.
“It hand-holds them for life through the process should something ever happen,” she said, while also advising residents to periodically check their accounts for fraudulent activity. “We can't say it enough, you just now have to be diligent of your own finances.”
Paul Stephens of Privacy Rights Clearinghouse said ProtectMyID, as well as similar products sold by other companies, serve as an early warning system after someone's been victimized.
“None of these services provide you with any sort of protection. It's a notification,” he said. “It helps you minimize the damage and let you know about it early in the game instead of at the point where accounts are open and statements have been sent to fraudulent addresses and you don't find out about it until months or years later when a collection agency tracks you down.”
ProtectMyID will alert customers via email or text when a new credit account has been opened. It can also alert customers to a bankruptcy, lien or civil lawsuit. It can't track the fraudulent use of existing credit cards or bank accounts.
Evan Hendricks, author of “Credit Scores & Credit Reports,” noted identity theft takes other forms, too. Social Security numbers can also be used to fraudulently apply for driver's licenses, passports and other documents – public records not covered by the monitoring service. When criminals use stolen identities, the victim could even unknowingly develop a criminal record, he said.
“Accept all free gifts,” Hendricks said about signing up for the Experian service. However, he added, “This is not the best service to have chosen,” saying others monitor more public records. He called it “negligent on the state's part” for not exploring them.
State officials have acknowledged they did not look beyond Experian, the same company contracted earlier this year by the Department of Health and Human Services after a project manager was accused of stealing information from 238,000 Medicaid patients. The state paid about $1 million for the roughly 30,000 people who signed up for a year's worth of the Experian service after that security breach.
Earlier this week, Haley negotiated a $12 million cap to the state's cost for the Department of Revenue computer hacking breach. As of Thursday, 521,000 people had signed up.
The service normally costs customers $160 yearly, or $16 monthly, Experian spokesman Greg Young said.
While taxpayers won't pay that for the year covered by the state, there are charges for other non-covered services.
Notably, ProtectMyID provides a single Experian credit report for the year. Each additional costs $10. Any credit report that also incorporates Equifax and TransUnion costs $32 each, reduced from the non-member rate of $40, Young said.
Hendricks, editor and publisher of Privacy Times, urged residents to take advantage of services they're entitled to by federal law at no cost, including one credit report yearly from each of the three credit bureaus and reports yearly from LexisNexis on insurance, employment and address records.
Steven Toporoff, an attorney with the Federal Trade Commission's identity protection division, suggests residents stagger their free reports, applying for one every four months. There's no predictable time frame between a security breach and when someone's identity is fraudulently used, since thieves often sell or trade the stolen information, he said.
He added that the 2003 federal law also entitles residents to place a fraud alert on their credit reports by calling one of the three bureaus, which is supposed to require creditors to take steps to confirm an applicant's identity. The FTC provides an online tool kit of what to do after becoming an identity theft victim.
Also, state law allows residents to freeze their credit, at no cost, by sending a written request to each credit bureau. Under state law, unfreezing it is free, too.
–Access to free credit reports available under federal law: annualcreditreport.com
–Access to free LexisNexis personal reports: personalreports.lexisnexis.com
–Federal Trade Commission's “protect your identity” tool kit: ftc.gov/bcp/edu/microsites/idtheft2012
–To sign up for Experian service paid for by the state: protectmyid.com/scdor