RiskPundit

The Phoenix New Times (via Wired) is reporting that LifeLock's CEO Todd Davis's identity was stolen 13 times. That's 12 more than had been previously reported. The question is, who's fault is it?

Clearly from a security perspective, it's not a good idea to display your Social Security Number on billboards and TV advertisements. However, from a marketing perspective it was brilliant. The actual dollar amounts lost due to these identity theft incidents were low. If those costs were simply written off as marketing expenses, it was a good deal for Todd Davis.

On the other hand, the legal expenses LifeLock has incurred are a different matter. I am not sure if the $12 million in legal judgments could also be simply written off as marketing expenses. I previously wrote about the $11 million and $1 million judgments
against LifeLock here.

LifeLock's identity theft protection is really limited to automatically posting "Initial Fraud Alerts" with the three consumer credit agencies, Equifax, Experian, and Trans Union.

The actual FTC complaint, in section 18 details the limitations of an "Initial Alert." In other words, there are many ways you can still suffer an identity theft attack with an Initial Alert turned on with all three consumer reporting agencies. Many of these are due to third parties not exercising the due diligence they should.

To my knowledge, only Equifax provides a service that actually enables you to LOCK your account. However, locking is not the silver bullet either as there are forms of identity theft that can be perpetrated without accessing your credit report. And since you can only lock Equifax, you are still vulnerable to Experian or TransUnion being abused. Finally, even if Experian and TransUnion added an easy locking process similar to Equifax's, you would have to pay fees to them as well.

SC Magazine reports:

LifeLock will pay $11 million to the Federal Trade Commission (FTC)
and $1 million to a group of 35 state attorneys general to settle
charges that the Tempe, Ariz.-based company made false claims about its
identity theft products.

The FTC contended that LifeLock's claims
were "deceptive" because the fraud alerts it places on customers'
credit files can only protect against certain types of identity theft,
such as new account fraud, which occurs when an ID thief opens up new
financial accounts by using the victim's name and Social Security
number.

In addition, ironically:

LifeLock, which bills itself as "#1 in identity theft protection," has
gained national notoriety with commercials that show Davis' Social
Security number on the side of a truck, while Davis tells the audience
that he is confident his company's services will protect him – and
potential customers – from having their identity stolen. But Davis
reportedly has been a victim of ID theft.

As I have said before, Identity Theft is a real problem. To protect yourself, start by reviewing the offerings of the three credit agencies Equifax, Experian, and TransUnion.