Identity Theft Protection: What's Worth Paying For (and What's Free)

The identity-theft-protection industry runs on fear, and it's worth naming the two facts it works hardest to obscure. First: no service can actually prevent your identity from being stolen — even the biggest names are, by their own description, alert systems that tell you after something has happened. Second: the single most effective protection against the most common kind of identity theft is completely free. That doesn't mean paid services are worthless — for some people they're a reasonable purchase — but you should do the free, high-impact things first and buy a service (if at all) for what it genuinely adds. This guide sorts out which is which.

That tool is IdentityTheft.gov, and our full terms are on our disclaimer page.

Who this is for, and how we chose what to cover

This is for a US consumer deciding whether to pay for identity-theft protection, or wondering what to do after a breach notice. It assumes no security background.

How we chose what to put in this guide:

• We lead with the free protections, because they cover the largest category of identity theft and cost nothing — and no article that sells you a subscription before telling you that is being straight with you.
• We do not rank the paid services or test them. We have tested none, their pricing is promotional and tiered, and a ranking would imply an evidence base we do not have.
• We name them anyway, with a link to each one's own page, because "consider paying for a service" is not advice you can act on without knowing which ones exist.
• We cover the protections that a credit freeze does not — tax-refund fraud, Social Security, medical identity theft — because the freeze's success at new-account fraud is exactly what makes those gaps easy to miss.

Who this is not for: if your identity has already been stolen, skip the whole decision and go to what to do right now.

The uncomfortable truth: "protection" mostly means "alerts"

Be clear-eyed about what you're buying. As the CFPB explains, identity-monitoring services can't prevent theft — they watch for signs of it and alert you so you can react faster. Even LifeLock, the category's most-advertised name, states plainly that it does not prevent identity theft and is an alert system. That's not a scandal; it's the nature of the product. But it reframes the decision: you're not buying a lock, you're buying a smoke detector and a cleanup crew — earlier warning and help recovering.

The point: paid services shorten detection and ease recovery; they do not build a wall around your identity. Judge them on that, not on the implied promise of prevention.

The flagship: do the free, high-impact things first

Before paying anyone, build this free stack — it stops or blunts the most damaging fraud at no cost:

1. Freeze your credit at all three bureaus (free, and the single most powerful step). A credit freeze locks lenders out of your credit report, so a thief can't open new accounts in your name — which is the largest category of identity theft. It's been free by law since 2018, doesn't affect your credit score, and doesn't touch your existing cards. You must place it separately at Equifax, Experian and TransUnion; unfreeze temporarily (also free) when you're applying for credit yourself. The FTC's own guidance on freezes and fraud alerts is the authority on your rights here.
2. Set a fraud alert (free) if you don't want a full freeze. It makes lenders verify your identity before granting new credit, lasts a year, is renewable, and you only contact one bureau — it notifies the other two.
3. Monitor your own accounts (free). Read card and bank statements, and pull your free credit reports at AnnualCreditReport.com — the same reports that drive your score, so you're checking two things at once. Most fraud shows up here first, and you'll catch it as fast as a paid alert.
4. Lock down logins (free). Unique passwords plus 2FA — a password manager makes this practical rather than theoretical — because a great deal of what gets called "identity theft" starts with a reused password rather than anything exotic.
5. Get an IRS Identity Protection PIN (free). A credit freeze does nothing about someone filing a tax return in your name and taking your refund, because that fraud never touches your credit report. An IP PIN is a six-digit number the IRS requires on your return; without it, a fraudulent electronic return in your name is rejected. It is open to any taxpayer who can verify their identity, not only past victims.
6. Claim your Social Security account (free). Create your my Social Security account, because an unclaimed account is one somebody else can claim with your details. Claiming it is the protection.
7. Opt out of pre-screened credit offers (free). Those pre-approved offers arriving by post are a mail-theft route into a new account in your name. OptOutPrescreen is the official opt-out operated by the credit reporting companies — five years online, or permanently by post. Note this is not a general marketing opt-out; it is specifically for firm offers of credit.

Bottom line: a free credit freeze plus self-monitoring covers the highest-risk scenario — new-account fraud — better than any paid monitoring plan, because it prevents the account instead of just reporting it. Do this first, whether or not you ever pay for a service.

Do them in this order

If you have one evening, this is the sequence, highest return first:

Everything above is free and takes one evening. That is the honest benchmark any paid service has to beat.

What you need before you start

Freezing is quick but it stops dead if you are missing one of these:

• Full legal name, address history for the last two years, date of birth and Social Security number. Bureaus verify identity from your credit file, so a recent move can complicate it.
• The ability to answer knowledge-based questions about old accounts — a mortgage servicer, a car payment. If you fail these online, the fallback is post or phone, which works but adds days.
• A place to record your freeze PINs. Some bureaus issue one; losing it makes thawing harder. Put them in your password manager, not a note on the fridge.
• About 30 minutes for all three, if the online verification works first time.

Credit freeze vs. fraud alert (the two free tools)

Both are free and neither affects your credit score, but they do different jobs and people routinely pick the weaker one:

Bottom line: a freeze is the stronger tool and the one to default to. A fraud alert is the reasonable choice only if you apply for credit often enough that thawing becomes a genuine nuisance.

Thawing, since this is the part people get wrong. You can lift a freeze temporarily (for a date range) or permanently, at each bureau, free, and online lifts are typically effective within about an hour. The catch is that you need to know which bureau the lender will pull — and many do not tell you in advance. If you do not know, lift all three for the window you need. Do it the day before, not while sitting at a dealership.

How to know the freeze actually took

This is the step almost everyone skips, and a freeze you believe you have is worse than none because you stop watching.

1. Get the confirmation from each bureau in writing — an email or a confirmation page — and keep all three together with the PINs.
2. Check each bureau separately. Freezing is three transactions, not one. The most common failure is completing two, being interrupted, and assuming the third went through.
3. Try to pull your own credit report while frozen. You should still be able to get your own report at AnnualCreditReport.com — a freeze blocks lenders, not you. If a report pull behaves unexpectedly, that tells you something about the account state.
4. Re-check after any life event that touches your file — a move, a name change, a bureau's own account migration. Freezes are durable, but the account they hang off is not always.

The test six months on: can you name all three bureaus and find your PINs in under a minute? If not, the freeze is fine and your ability to use it is not — and that friction is what makes people permanently lift a freeze they should have kept.

What paid services actually add

Beyond what you can do free, a paid service typically bundles: dark-web/identity monitoring (alerts if your SSN or data surfaces), data-broker removal (getting your info pulled from people-search sites), restoration assistance (a specialist who helps you clean up after theft), and identity-theft insurance (reimbursing certain recovery costs, often advertised "up to $1 million"). Plans commonly run ~$8–$35/month (illustrative).

Two honest caveats about the insurance, because the "$1 million" headline is misleading:

• It generally doesn't cover money stolen from you — most claims are for legal fees and credit-repair costs, not stolen funds. Your stolen money is recovered through your bank under Regulation E (debit) and the Fair Credit Billing Act (credit cards), which cap your liability regardless of whether you have a service — but the two are not equal. Credit-card fraud liability is capped at $50 (issuers usually waive it to $0), while debit-card protection is time-sensitive: report within 2 business days and you're capped at $50, within 60 days at $500, but wait past 60 days and you can be liable for everything. That asymmetry is a real reason to put online purchases on a credit card and to report debit fraud immediately.
• It won't cover pre-existing theft (anything that started before you subscribed), and reimbursement usually requires documentation and a police report.

The services, named and unranked

Five a US consumer will encounter, alphabetically, not ranked, not tested by us, with no price or tier asserted here. Each link goes to that company's own page, where the current pricing lives:

• Aura
• Identity Guard
• IdentityForce
• IDShield
• LifeLock (Norton)

What to compare, since we are not doing it for you: (1) whether restoration is full-service — a specialist who acts with limited power of attorney — or a call centre that emails you instructions you could have got free from IdentityTheft.gov; (2) whether family or child cover is included or extra; (3) what the insurance actually schedules as covered expenses, which is in the policy document, not the marketing page; (4) whether data-broker removal is included and how many brokers; and (5) the renewal price after the first year, which is where the economics of a promotional signup live.

Our take — and this is opinion, plainly labelled: the genuine value of a paid service is time and stress — earlier alerts and a professional handling recovery — not getting your money back, which the law already handles. Pay for the convenience and the recovery help if you want them, not for the insurance headline.

So — is it worth paying?

It depends on one honest question: will you actually do the free stuff and monitor yourself? A reasonable framework:

• Skip it if you'll freeze your credit and glance at your statements — you've captured most of the protection for free.
• Consider paying if you won't reliably self-monitor, you've been in major breaches and want dark-web alerts, you want a specialist to handle recovery (the average victim spends 200+ hours and ~$1,300 cleaning up — illustrative figures), or you value the peace of mind. Households with complex finances or higher exposure benefit most.

Bottom line: a paid service is a convenience-and-recovery purchase, not a prevention one. It's worth it for people who won't self-monitor or who want professional recovery help — and largely redundant for people who'll freeze their credit and stay alert.

A worked example: three people, three different answers

Illustrative cases. What varies is only what actually drives the decision: whether they will self-monitor, what is uniquely exposed, and whether anyone else depends on them.

Dan — where paying would buy nothing. Take someone with a single bank, one credit card, and an evening free. He freezes all three bureaus, gets an IP PIN, puts unique passwords behind a manager, and checks his statements. A $15/month subscription would add dark-web alerts telling him about leaks he has already mitigated — the freeze means a leaked SSN cannot open an account. For Dan the honest recommendation is to spend the money on nothing.

Maria — where the subscription earns its price. Suppose you run two businesses, hold six accounts, and have not opened a statement carefully in a year. The free stack is still step one and still free. But the argument for paying is not the monitoring — it is that if something goes wrong, recovery is dozens of hours she does not have, across accounts she cannot easily reconstruct. She is buying labour, not protection, and that is a legitimate purchase. What she should check before buying is comparison point (1) above: full-service restoration or a call centre.

The Alvarados — where the important action is free and almost unknown. Imagine parents doing everything right for themselves and not knowing that a child's credit file is the most valuable target there is — unused, unmonitored, and typically not discovered until the child applies for a first loan at eighteen. Freezing a minor's credit is free, is a right under federal law, and is a separate process from an adult freeze: each bureau has a dedicated minor-freeze route requiring proof of identity and guardianship, usually by post. It takes an afternoon once and protects a decade.

What these assume, and what would change them. They assume none of the three has already been a victim — if so, recovery comes first and the buying decision waits. They assume US residency and US credit files. Maria's calculation changes if her businesses are incorporated and hold their own credit, which is a distinct exposure a consumer service does not cover.

If your identity is already stolen

Start at IdentityTheft.gov, the FTC's official recovery service. It generates a personalised recovery plan, produces the FTC Identity Theft Report you'll need when disputing accounts, and pre-fills the letters. This is free, it is the government's own tool, and it does the single thing paid services charge most for — telling you what to do, in order, after the fact.

Don't buy a service in a panic — go to the FTC's IdentityTheft.gov, which gives a free, official, step-by-step recovery plan and generates the affidavits you'll need. Then freeze your credit, dispute fraudulent accounts, and report stolen funds to your bank (which must limit your liability under Reg E / the Fair Credit Billing Act).

The order that matters, because doing these out of sequence costs time:

1. Report to IdentityTheft.gov and get the FTC Identity Theft Report. Do this first: it is the document every later dispute asks for, and generating it after you have started disputing means redoing them.
2. Call the fraud department of any affected institution — not general customer service. Ask for the account to be closed and flagged as fraud, not merely disputed.
3. Freeze all three bureaus if you have not.
4. Report debit-card fraud to your bank immediately — the Reg E clock is the tightest deadline in this article.
5. Dispute the fraudulent accounts with the bureaus, attaching the FTC report.
6. File a police report if you need one — some institutions require it, and it is worth asking which do before you spend the afternoon on it.
7. Change passwords, starting with the email account, because it is the reset route into everything else.
8. Keep a log of every call, with date, name and reference number. This becomes the record you rely on months later.

How long recovery takes depends entirely on what was opened in your name and how many institutions are involved — a single fraudulent card is a matter of calls; a mortgage or a tax return is longer. Bureaus generally have a defined window to investigate a dispute, and institutions have their own. Nobody can honestly give you a total, and any service that promises one is selling.

What to do: IdentityTheft.gov first — it's free and it's the plan the paid "restoration" teams are largely helping you execute anyway.

If you just got a breach notice

Common and rarely as urgent as it feels. Three things, in order:

1. Read what was actually exposed. An email address is not a Social Security number. The notice must say, and the appropriate response scales with it.
2. If an SSN was involved, freeze — if you have not already. This is the response, and it is better than anything the notice offers you.
3. The free credit monitoring they offer is worth taking and worth nothing much. Take it — it is free — but understand it is monitoring, not prevention, and it typically expires in a year while your SSN does not change. It is not a substitute for the freeze, and accepting it should never be the only thing you do.

Common mistakes

• Paying for a service while skipping the free credit freeze. The freeze is the strongest tool and it's free; buying monitoring without it is backwards.
• Believing "protection" prevents theft. It alerts and helps you recover — nothing more.
• Trusting the "$1M insurance" to refund stolen money. It usually doesn't; your bank does, under federal law.
• Panic-buying after a breach. Freeze your credit (free) and use IdentityTheft.gov (free) first.
• Reusing passwords. A huge share of identity fraud starts with a leaked, reused login.
• Freezing two bureaus and believing you froze three.
• Assuming a freeze covers tax-refund fraud. It does not; the IP PIN does.
• Forgetting children's credit files, which are the most valuable and least watched.
• Permanently lifting a freeze after applying for credit and never re-placing it.
• Disputing accounts before generating the FTC Identity Theft Report, and having to start the disputes again.

Putting it together

The most effective identity protection is mostly free: freeze your credit at all three bureaus, watch your own statements, and lock down your logins. That single set of steps stops the most damaging fraud — new accounts opened in your name — better than any paid monitoring plan. A paid service is then an honest, optional purchase for earlier alerts and hands-on recovery help, valuable mainly if you won't monitor yourself. Buy it for what it really is — a smoke detector and a cleanup crew — not for a promise of prevention no service can keep.

Your next three moves, in order: (1) freeze all three bureaus tonight and save the confirmations and PINs where you will find them; (2) get an IRS IP PIN, because it covers the fraud the freeze cannot; (3) only then decide whether a paid service adds anything you will not do yourself.

Where to go from here

• The reused password is the entry point in a large share of these stories; setting up a password manager properly is the highest-value follow-up.
• Pulling your credit reports serves two purposes at once — what actually moves your credit score covers the other one.
• If something has already happened, IdentityTheft.gov is the free official starting point, and it is better than anything in this category you could buy.

Our full terms are on our disclaimer page.

FAQ

(Only questions the body doesn't fully answer.)

• Will I get my stolen money back? Usually yes, and not because of an ID-theft service — federal law limits your liability for fraudulent charges: Regulation E for debit-card fraud and the Fair Credit Billing Act for credit cards. One crucial difference: credit-card liability is capped low (often $0), but debit protection weakens the longer you wait — $50 if reported within 2 business days, up to $500 within 60 days, and potentially unlimited after — so report debit fraud to your bank immediately.
• Does a credit freeze hurt my credit score or block my own cards? No. A freeze doesn't affect your score and doesn't touch existing accounts — it only blocks new credit inquiries until you lift it.
• Is dark-web monitoring worth it? It's the clearest thing a paid service adds that you can't easily do yourself, but it's an alert, not a fix — if your data's already leaked, the action is still to freeze your credit. Useful, not magic.
• Do I need a service if I already froze my credit? For most people, no — the freeze covers the biggest risk. A service mainly adds monitoring and recovery help, which matter more if you won't self-monitor.
• Should I freeze at the smaller bureaus too? There are specialist bureaus beyond the big three — for rentals, employment screening, and check-writing. Freezing them is possible and free, and is worth the extra effort mainly if you have already been a victim or your SSN is known to be circulating. For most people the big three capture the risk.
• Can I freeze my child's credit? Yes, free, and it is a right under federal law. It is a separate process at each bureau requiring proof of identity and guardianship, usually by post. Most children have no credit file until you request the freeze, at which point one is created and immediately frozen — which is exactly what you want.
• Does the IP PIN have to be renewed? For most enrolees the IRS issues a new one each year, and you need the current one to file. Note where it arrives and diary it, because a missing IP PIN will reject your own return as effectively as a fraudster's.
• What about medical identity theft? A credit freeze does not cover it, and it surfaces differently — an unfamiliar explanation of benefits, or a collection notice for care you did not receive. Read your explanations of benefits, and request your medical records if something looks wrong. IdentityTheft.gov covers this case too.
• Is a VPN or antivirus part of this? They address different risks and neither prevents identity theft. Useful in their own right; not a substitute for a single item in the free stack above.