Recent GAO Report Finds ID Theft Services are Great, but are Limited

A recently released Government Accountability Office (GAO) report documented that while there are benefits, the various complimentary identity theft protection services offered after a data breach are not the end all, be all solution to protecting one’s credit, identity, or for preventing fraud. In addition, most of them do not provide medical identity theft or tax return fraud protection, which are becoming more important as these types of theft are on the rise.

The GAO report analyzed the services after the 2015 data breach of the Office of Personnel Management (OPM) that affected over 21.5 million people. Cyberthieves broke into the OPM systems and stole a significant amount of personal and sensitive information including social security numbers, names, addresses, job history, and in some cases fingerprint details.

After that incident, the OPM offered identity protection services to a select group of those affected. The GAO report found the services provided by the ID protection services were lacking specifically in the area of medical and tax return fraud. It found that only one in 26 did address medical identity theft and it was not offered as a consumer product; rather as a benefit to covered members of health insurance plans.

While this may be true, any time a free identity protection service is offered as a result of a data breach, it is a wise choice to take advantage of it. The benefits that these can provide are to warn the covered person of any attempts to get credit reports or obtain credit. Once an alert is sent, an immediate follow up should occur to prevent possible or further damage. The sooner any fraud is addressed, the better.

However, because there are limitations it is always advised to take a proactive stance with one’s identity and credit. Always closely monitor payment card charges and credit reports. Report suspicious activity immediately. Also, be sure to file tax returns early and report stolen social security numbers to the IRS rather than waiting for a service or the breached organization to do it on your behalf.

Also, be sure to monitor the benefit statements for any healthcare services received. If something on those looks amiss, take the time to research and correct it with the healthcare provider and insurance company.

The GAO report also looked at various cybersecurity insurance plans. It found that those policies were largely not worthwhile because “claims paid rarely exceeded a few thousand dollars.”

The Inspector General for the OPM determined in 2005 that the information maintained on its systems was vulnerable to hackers. In a 2016 report from the Office of the Inspector General (OIG), it was documented that the OPM failed to prioritize cybersecurity and that it partially contributed to the data breaches there.