Data Breaches: Range of Consumer Risks Highlights Limitations of Identity Theft Services

Recent large-scale data breaches of public and private entities have put hundreds of millions of people at risk of identity theft or other harm. GAO was asked to review issues related to consumers' options to address risks of harm from data breaches. This report, among other things, examines information and expert views on the effectiveness of consumer options to address data breach risks. GAO analyzed available data on options, collected and analyzed related documentation, conducted a literature review of studies, and interviewed a nongeneralizable sample of 35 experts (from academia, government entities, consumer and industry organizations) and identity theft service providers to reflect a range of views.

No one solution can address the range of potential risks from a data breach, according to interviews with academic, consumer, government, and industry experts and documentation GAO reviewed. Perpetrators of fraud can use stolen personal information—such as account numbers, passwords, or Social Security numbers—to take out loans or seek medical care under someone else's name, or make unauthorized purchases on credit cards, among other crimes. Foreign state-based actors can use personal information to support espionage or other nefarious uses.

Public and private entities that experience a breach sometimes provide complimentary commercial identity theft services to affected individuals to help monitor their credit accounts or restore their identities in cases of identity theft, among other features. Consumers also may purchase the services. As of November 30, 2018, the Office of Personnel Management (OPM) had obligated about $421 million for a suite of credit and identity monitoring, insurance, and identity restoration services to offer to the approximately 22 million individuals affected by its 2015 data breaches. As of September 30, 2018, about 3 million had used the services and approximately 61 individuals had received payouts from insurance claims, for an average of $1,800 per claim. OPM re-competed and awarded a contract to the previously contracted company in December 2018.

GAO's review did not identify any studies that analyzed whether consumers who sign up for or purchase identity theft services were less subject to identity theft or detected financial or other fraud more or less quickly than those who monitored their own accounts for free. A few experts said consumers could sign up for such services if offered for free. Credit monitoring may be convenient for consumers and personalized restoration services may help identity theft victims recover their identities, but such services do not prevent fraud from happening in the first place. The services also do not prevent or directly address risks of nonfinancial harm such as medical identity theft.

Consumer, government, and industry experts highlighted other free options, including a credit freeze, which prevents one type of fraud. A freeze restricts businesses from accessing a person's credit report—and can prevent the illicit opening of a new account or loan in the person's name. A provision of federal law that took effect in September 2018 made it free for consumers to place or lift credit freezes quickly at the three nationwide consumer reporting agencies (Equifax, Experian, and TransUnion). Consumers also can regularly monitor their accounts and review their credit reports for free every 12 months. In addition, they can take advantage of free federal assistance such as the guidance on the Federal Trade Commission's IdentityTheft.gov website.

Finally, large amounts of personal information are outside of consumers' control and bad actors can use stolen information for years after a breach. Therefore, experts noted that data security at entities that hold such information—and efforts to make stolen information less useful for identity thieves, through use of new identity verification technologies, for example—are important ways to mitigate risks of harm for consumers.

GAO reiterates a matter for congressional consideration and a recommendation from its 2017 report on identity theft services ( GAO-17-254 ). In that report, GAO found that legislation requiring federal agencies that experience data breaches, including OPM, to offer certain levels of identity theft insurance coverage to affected individuals requires coverage levels that are likely unnecessary. Therefore, Congress should consider permitting agencies to determine the appropriate coverage level for such insurance. GAO also recommended the Office of Management and Budget (OMB) update its guidance for agency responses to data breaches, after analyzing the effectiveness of identity theft services relative to lower-cost alternatives. OMB did not agree or disagree and had not taken action as of early March 2019.

Sensitive personal information—such as Social Security numbers or  dates of birth—can be exposed in several ways, including on a very large  scale through a data breach. For example, major retail and hotel chains  have suffered data breaches that exposed the identifying information,  including financial account or Social Security numbers, of millions of  people. Consumers whose information is exposed can be at risk of a  range of harms, including identity theft or fraud. Consumers can try to  prevent or mitigate these harms in a number of ways, such as monitoring  their credit reports and credit card statements for suspicious activity, or  placing a credit freeze that restricts access to their credit report. They  also may enroll in free or fee-based identity theft services. Private-sector  and government entities that experienced data breaches have provided  these services to millions of affected consumers.

In March 2017, we reported on the potential benefits and limitations of  commercially available identity theft services and factors that affect  public- and private-sector decision-making about them. Since that time,  additional large-scale data breaches have occurred and Congress passed  legislation that enhances some of the options available to consumers to  prevent or mitigate identity theft. You asked us to review issues related to  actions consumers can take to address risks of harm from data breaches.  This report examines (1) information and expert views on the  effectiveness of options consumers can use to prevent or address the  risks resulting from data breaches; and (2) federal assistance available to  help consumers understand these options, including the status of one  matter for congressional consideration and one recommendation relating  to these issues in our 2017 report.

To address the first objective, we conducted a literature review to identify  any studies or independent research on the effectiveness of consumers’  options for mitigating or preventing harm from exposure of personal  information. We also searched for studies that examined consumer  attitudes and behavior following data breaches, and harms to individuals  from data breaches. We interviewed a nongeneralizable sample of  experts and private companies that provide identity theft services to  consumers. Specifically, we interviewed representatives of 35 entities in  the following categories: academic or independent research institution (4);  consumer or privacy research and advocacy (10); industry association or  identity theft service provider, or industry consultant (12); and federal or  state government (9). We selected the experts and identity theft service  providers to represent a range of perspectives. We also reviewed  provisions in the Economic Growth, Regulatory Relief, and Consumer  Protection Act, enacted in May 2018, that address credit freezes and fraud alerts (two tools for preventing one type of identity theft).  Furthermore, we reviewed the evidence collected for the 2017 GAO  report on identity theft services.

To address the second objective, we reviewed documentation and  interviewed staff from the Federal Trade Commission (FTC), Consumer  Financial Protection Bureau (CFPB), and Office of Personnel  Management (OPM). We analyzed data from the company that  contracted to provide identity theft services to individuals affected by two  data breaches at OPM in 2015. We assessed the reliability of the data by  interviewing agency officials and reviewing documentation about the  systems used to store the data. We found the data to be reliable for  purposes of this reporting objective. We also reviewed documentation  and interviewed agency staff about the development, implementation, and  assessment of their consumer education materials and other resources  and assistance. We compared these activities against a 2014 Executive  Order on the security of consumer financial transactions, key practices for  consumer education planning identified in our prior work, and federal  standards for internal control. In addition, we followed up on  recommendations made in our 2017 report. For more information on our  scope and methodology, including the organization representatives we  interviewed, see appendix I.

We conducted this performance audit from November 2017 to March  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Harm from Exposure of Personal Information

Individuals’ sensitive personal information can be lost, stolen, or given  away. Once exposed, individuals’ information can be misused to commit  identity theft, fraud, or inflict other types of harm. Identity theft occurs  when individuals’ information is used without authorization in an attempt  to commit fraud or other crimes. In 2016, according to the Bureau of  Justice Statistics, an estimated 26 million people—10 percent of U.S.  residents aged 16 or older—reported that they had been victims of  identity theft in the previous year. One potential source of identity theft is  a data breach at an organization that maintains large amounts of  sensitive personal information. Recent data breaches include the 2018  breach of Marriott International’s Starwood guest registration database,  which may have exposed information of millions of individuals, and the  2017 data breach at Equifax, Inc., a nationwide consumer reporting  agency, which exposed identifying information of at least 145.5 million  people. The types of harm that can result from exposure of sensitive  personal information include the following:

Financial fraud from identity theft, which can include new-account fraud, in which thieves use identifying data, such as  Social Security and driver’s license numbers, to open new  financial accounts without that person’s knowledge; and, existing-account fraud, which is more common and entails the  use or takeover of existing accounts, such as credit or debit card  accounts, to make unauthorized charges or withdraw money.

Tax refund fraud, which occurs when a Social Security number or  other personally identifiable information is used to file a fraudulent tax  return seeking a refund.

Government benefits fraud, which occurs when thieves use stolen  personal information to fraudulently obtain government benefits. For  example, the Social Security Administration has reported that  personal information of beneficiaries has been used to fraudulently  redirect the beneficiary’s direct deposit benefits.

Medical identity theft, which occurs when someone uses an  individual’s name or personal identifying information to obtain medical  services or prescription drugs fraudulently, including submitting  fraudulent insurance claims.

Synthetic identity theft, which involves the creation of a fictitious  identity, typically by using a combination of real data and fabricated  information. The federal government has identified synthetic identity  theft as an emerging trend.

Child identity theft, which occurs when a child’s Social Security  number or other identifying information is stolen and used to commit  fraudulent activity.

Other types of fraud that occur when personal information is used;  for example, to set up mobile phone or utility accounts, or to engage  in activities such as applying for employment or renting a home.

The harms caused by exposure of personal information or identity theft  can extend beyond tangible financial loss, including the following:

Lost time. Victims of identity theft or fraud may spend significant  amounts of time working to restore their identities. In 2016, according  to the Bureau of Justice Statistics survey of identity victims, most  victims resolved issues in 1 day or less but about 1 percent of victims  spent 6 months or more resolving their identity theft issues.

Emotional distress and reputational harm. Exposed information  also can cause emotional distress, a loss of privacy, or reputational  injury. In 2016, according to the Bureau of Justice Statistics, about 10  percent of those who experienced identity theft reported suffering  severe emotional distress.

Harm from state-based actors. State-sponsored espionage can  cause harm to individuals when nations use cyber tools as part of  information-gathering, espionage, or other nefarious activities.

Consumers’ Options to Address Risks or Harm

Options available to consumers to help prevent or mitigate identity theft  include actions they can take on their own (generally for free) or services  they can purchase.

Actions individual consumers can take themselves include the following:

Placing a credit freeze. A credit or security freeze restricts potential  creditors from accessing a credit report until the consumer asks the  agency to remove or temporarily lift the freeze.

Placing a fraud alert. A fraud alert on a credit report requires  businesses to verify a consumer’s identity before they issue credit.

Monitoring accounts and other information.

Reviewing free annual credit reports. Individuals can request  one copy of their credit report every 12 months (available for free  at AnnualCreditReport.com).from each of the three nationwide  consumer reporting agencies.

Reviewing financial statements and other accounts.

Individuals can review bank and other financial statements  regularly for suspicious activity and make use of automatic  transaction alerts and other free features that financial institutions  offer to detect potential fraud. Individuals also can regularly review  mobile phone or utility accounts for unusual activity.

Reviewing health insurance benefits explanations and  medical information. Individuals can review explanation-of- benefits statements from their health insurer to detect fraudulent  insurance claims or monitor their files at their healthcare providers  to detect unauthorized use of medical services.

Consumers also can obtain various free or fee-based identity theft  services, which are commercial products that generally offer tools  intended to help consumers detect identity theft and restore their identity  if it has been compromised. The private research firm IBISWorld  estimated that the U.S. market for identity theft services was about $3  billion annually in 2015–2017. The services may be marketed directly to  individuals for a monthly or annual fee. In addition, private- and public- sector entities that have experienced data breaches sometimes purchase  these services and offer them to affected individuals at no cost.

Identity theft services most often include credit monitoring, which tracks an individual’s credit reports and  sends alerts about potentially suspicious activity;  identity monitoring, which aims to monitor other sources such as  public records and illicit websites (sometimes referred to as the  “dark web”);  identity restoration, which provides a range of services to  recover from identity theft; and  identity theft insurance, which reimburses individuals for certain  costs related to the process of restoring identities.

Other actions consumers can take to protect their identity include  adoption of certain data security practices and early filing of tax returns.  Data security practices can help protect sensitive information. For  example, individuals can change or avoid sharing or re-using passwords,  and make use of strong passwords and authentication options on online  accounts; properly safeguard or shred sensitive paper documents; and  limit access to their sensitive information on social media. Filing a tax  return early reduces the risk of tax refund fraud, and some victims of tax  refund fraud may be eligible for an Identity Protection Personal  Identification Number (PIN)—issued by the Internal Revenue Service  IRS)—to prevent future fraud. To protect their Social Security benefits,  individuals can set up an online account at the Social Security  Administration to monitor their benefits accounts.

Limited Information Is Available on Effectiveness of Options after Data Breaches, but Credit Freezes Can Prevent New-Account Fraud

We did not identify any studies that analyzed whether consumers who  sign up for or purchase identity theft services encounter fewer instances  of identity theft or detect instances of financial or other fraud more—or  less—rapidly than consumers who take steps on their own. Views of  experts varied, but most said identity theft services have limitations and  would not address all data breach risks. Most experts also said that a  credit freeze, which consumers place on their own for free, is a useful  way to prevent one type of financial fraud—the illegal opening of new  credit accounts in consumers’ names. Based on our review and  discussions with experts, consumers can consider four factors when  deciding on options to address risks after a data breach: the extent to  which an option might prevent fraud; the cost of an option; its  convenience; and the type of information that was exposed and may be at  risk.

No Independent Research Assesses Effectiveness of Consumer Options to Address Risks after Data Breaches

Information that can help consumers assess their options for mitigating  and addressing the risks of identity theft and other harm from data  breaches is limited. Specifically, we did not identify any studies that  analyzed whether consumers who sign up for free or purchase identity  theft services encounter fewer instances of identity theft or detect  instances of financial or other fraud more—or less—rapidly than  consumers who take steps on their own for free—such as monitoring their  credit reports or placing a credit freeze. For consumers who experienced  identity theft, we did not find any studies that compared the effectiveness  of free options to help consumers recover from identity theft with  commercial identity restoration services. In addition to searching  databases of scholarly publications and other sources, a range of  academic, consumer, government, and industry experts we interviewed  told us that they were unaware of any specific independent studies on the  effectiveness of consumer options.

We interviewed representatives of seven companies that provide identity  theft services about how they assess the effectiveness of their services  and found that what they measure does not directly address how effective  these services would be in mitigating the risks of identity theft compared  with options consumers can take on their own. For example, two  company representatives said that their services focus on detection of  fraudulent activity or assistance after identity theft has occurred, rather  than on prevention of identity theft or other harms. The representatives of  each of the providers said that their companies generally measure how  customers use their products and services; customer satisfaction (for  example, through surveys or other feedback); and whether the products  work as intended (for example, whether alerts of fraudulent activity are  successfully delivered to customers or customers can successfully  access the company’s website when they need to). Companies that offer  identity restoration services also measure the rate at which they complete  the process of recovering stolen identities. While it is not possible to  prevent identity fraud, four representatives said that early detection of  fraud is important as it allows consumers to address potential fraud more  quickly.

FTC, a primary source for assistance to consumers on issues related to  data breaches and identity theft, has advised consumers that the  effectiveness of services that offer identity monitoring depends on factors  such as the kinds of databases the service provider monitors, how well  the databases collect information, and how often the service provider  checks each database. For example, FTC suggests that consumers ask  if service providers check databases that show payday loan applications  or changes in addresses for misuse of their information as part of identity  monitoring. In reviewing consumer education and promotional materials  on the websites of five identity theft service companies we contacted that  offer identity monitoring, we found that three providers included  information about which types of databases they monitor; the other two  did not.

Government and commercial entities—such as federal agencies and  retail stores—that decide to purchase identity theft services to offer to  affected individuals after a breach of their data do not necessarily base  their decision on how effective these services are. Rather, according to  industry and some government representatives we interviewed, some  base their decisions on federal or state legal requirements to offer such  services and the expectations of affected customers or employees for  some action on the breached entities’ part. Representatives of retail and  banking associations we interviewed indicated that it has become the  industry standard to offer 1 year of credit or identity monitoring services in  the wake of a data breach. One industry representative said that in some  cases the decision is not based on the effectiveness of the services.  States such as California require companies to offer some type of identity  theft service after a data breach. Moreover, Connecticut requires health  insurers and certain health care-related companies to offer identity theft  services following an actual or suspected data breach. In 2017, we  reported that companies do not assess the effectiveness of an identity  theft provider’s services when selecting a vendor to provide such  services. Rather, they consider other selection factors, including price,  reputation, capacity to respond quickly to large-scale breaches, and  ability to provide comprehensive post-breach services, such as complying  with statutory notification requirements. But companies that purchase  identity theft services may be in a position to obtain more detailed  information from potential providers than is publicly available to  consumers.

Views of Experts Varied, but Most Said Identity Theft Services Have Limitations and Would Not Address All Data Breach Risks

In the absence of independent evidence of the effectiveness of identity  theft mitigation options, we interviewed representatives and reviewed  consumer education materials, working papers, and articles from  academic, consumer, industry, and government entities. No one solution  can protect against the full range of risks to individuals whose personal  information was exposed in a data breach, based on our review of  documentation and the views of academic, consumer, government, and  industry experts. We obtained perspectives on the value of options  available to consumers. The following summarizes key observations:  Identity theft services. Representatives of 9 of the 10 consumer groups  we interviewed generally viewed credit or identity monitoring (or both) to  be of limited value. However, one consumer group representative noted  that identity monitoring might be useful in circumstances in which Social  Security numbers were compromised. In addition, a few consumer group  representatives indicated that consumers could consider signing up for  such services if they are offered for free. If identity theft services are not  free, FTC and CFPB consumer education materials recommend that  consumers consider the benefits and limitations of such services and  compare them to free or low-cost options before signing up. A few  consumer groups and one academic highlighted that consumers may not  fully understand the limitations of signing up for identity theft services. A  few consumer group representatives and one industry and state  government representative cautioned that free services may be offered for only 1 or 2 years; exposed information can be used for identity theft or  other harms over a much longer period. For example, in 2017, we  reported that nation-state actors that steal consumer data as part of their  espionage activities can wait much longer than a private identity thief to  use compromised information (if at all), according to one identity theft  service provider. In addition, CFPB consumer information and a few  consumer group representatives noted that consumers should be aware  that some services may try to charge consumers after the free period  ends.

Some consumer group and one industry representatives also said that  the value of one feature of identity monitoring—dark web monitoring—is  unclear. One representative said that there is nothing new that  consumers can do once they learn their information was found on an illicit  website. Rather, they must continue to monitor their accounts as they  already should have been doing. In addition, one consumer group  representative indicated that these services may provide consumers with  a false sense of security.

Experts we interviewed for our 2017 report said that identity restoration in  particular could be helpful to consumers. FTC staff and one consumer  group representative we interviewed said that one-on-one assistance can  be helpful. Identity restoration typically is included with other identity theft  services rather than offered as a stand-alone service. However, the level  of service provided in identity restoration can vary substantially—some  providers offer individualized hands-on assistance, while others largely  provide self-help information that is of more limited value. In our 2017  report, we also found that another feature of identity theft services,  identity theft insurance, may provide minimal benefits for consumers.  More details about identity theft insurance appear later in this report.

Options to prevent fraud or harm unrelated to credit accounts.  Consumers have limited options to mitigate risks of other harms from data  breaches, such as medical identity theft and identity theft tax refund fraud.  Commercial identity theft services, credit freezes, and fraud alerts do not  directly address these risks. Some consumer, government, and industry  representatives cited self-monitoring as a way for consumers to be on the  alert for these other types of fraud.

Consistent with our 2017 report, identity theft service providers we  interviewed generally indicated that their products and services do not  directly monitor for these types of fraud. However, two noted that they  would assist with any identity restoration involving medical identity theft,  tax refund fraud, or government benefits fraud (such as fraudulently  redirecting Social Security benefits). Identity theft services also may  address these types of fraud indirectly—for example, detecting a  fraudulent change of address can prevent sensitive health insurance  information from being redirected to the fraudster. A few consumer  groups said that consumers may not understand which risks commercial  identity theft services address. Additionally, we reported in 2017 that  identity theft services do not address non-financial harms, such as  emotional distress, embarrassment, and harm to one’s reputation. For  example, a House Committee report on the OPM data breaches noted  that the information stolen from background investigations included some  of the most intimate and potentially embarrassing aspects of a person’s  life, such as mental health history, misuse of alcohol or drugs, or  problems with gambling. Identity theft services also may be of limited  value in cases of nation-state espionage. For example, in 2017, we  reported that when the source of the data breach appears to be a nation  state (as opposed to a private party), the risk of the information being sold  for monetary purposes is likely to be lower, according to an FTC  representative.

Importance of data security. In the view of some experts, entities such  as the federal government and private companies that hold consumer  data have a responsibility to protect those data. A few experts said that  the burden should not be on consumers to protect data they do not  control. Except in certain circumstances, companies are generally not  required to be transparent about the consumer data they hold or how they  collect, maintain, use, and secure these data. Identity theft service  providers may contract with third parties such as consumer reporting  agencies or with third-party identity monitoring providers, such as dark  web monitoring services. Moreover, one consumer group representative  noted that identity monitoring services require consumers to provide  additional personal information to enroll—which also could be  compromised if the service provider’s information were breached.

Finally, consumer group and government researchers we interviewed  suggested other options that entities can (or already) use to address risks  of harm. For example, one government researcher noted that financial  institutions have started to use multifactor authentication and other  technologies that can help institutions verify a consumer’s identity and  thus help prevent fraud. Multifactor authentication involves first logging  into an online account using the traditional username and password, and  then the institution sending a verification code to a mobile phone or e-mail  address that the consumer must enter as part of the log-in process. In  addition, one researcher noted that some institutions have started to use  facial recognition technology, or to ask an account holder to provide  answers to questions such as the size of the account holder’s last  deposit. Other biometric technologies such as fingerprint recognition on  mobile phones, or one-time passcodes that are synced with financial  institutions’ websites, also can help, according to one researcher and one  consumer group representative. Other strategies can focus on reducing  the riskiness of breaches by making information less useful for purposes  of committing identity theft. For example, one researcher noted that  organizations could encrypt data or use tokens so static account numbers  could not be used on their own. There is no single solution to address all  risks of harm, based on our review of documentation and the views of  academic, consumer, government, and industry experts.

Consumers Can Use Free Credit Freezes and Fraud Alerts to Effectively Prevent New-Account Fraud

A credit freeze is the only consumer option that can prevent one type of  identity theft-related fraud, and recent federal legislation made credit  freezes free and easier to place or lift. This option is effective because it  restricts potential creditors from accessing a consumer’s credit report to  open a new account until the consumer asks the nationwide consumer  reporting agency to remove or temporarily lift the freeze. In contrast,  identity theft services and self-monitoring detect or remediate identity theft  after it has occurred, but do not prevent the fraud from occurring in the  first place. We interviewed representatives, or reviewed the consumer  education or informational materials, of consumer, industry, and  government entities and found that almost all of them included credit  freezes on credit reports as a useful consumer option to protect against  identity theft.

More specifically, the Economic Growth, Regulatory Relief, and  Consumer Protection Act, which took effect on September 21, 2018,  required the three nationwide consumer reporting agencies (Equifax,  Experian, and TransUnion) to make placing and lifting freezes free and  specifies that the agencies must place a freeze within 1 business day,  and lift it within 1 hour, of receiving a telephone or electronic request (see  fig. 1). Consumers must contact each of the three agencies individually  and request the freeze. Consumers obtain a PIN from each company,  which enables them to lift or remove a freeze at a later date. Before the  2018 act, consumers typically had to pay $5-$10 per agency to place a  credit freeze. Some experts had noted cost and inconvenience as some  of the limitations to a credit freeze. The new law addresses these  concerns to some degree by making credit freezes free and requiring  these consumer reporting agencies to lift freezes expeditiously on  request.

While the new law removed some barriers to placing credit freezes,  others still exist and the freezes have some limitations. For example,  consumers still have to lift a freeze before applying for a loan or new  credit account and need to place or remove a freeze at each consumer  reporting agency separately, which could cause delays for consumers  actively shopping for a home, car, or other purchase requiring the  extension of credit. Two consumer groups said that there is confusion  about how the law would affect minor children. (Under the new law, credit  freezes only can be placed on behalf of children under age 16, but not  minors ages 16 and 17—who must place freezes themselves).

Moreover, as the new law only applies to the three nationwide consumer  reporting agencies, credit freezes do not protect against new-account  fraud resulting from the use of credit reports from other consumer  reporting agencies. For example, one consumer group recommended that  consumers place a fourth freeze with the National Consumer Telecom  and Utilities Exchange—a consumer reporting agency that maintains  credit reports that telecommunications or utilities companies may use to  check the creditworthiness of consumers interested in opening phone or  utility accounts. The law also permits insurance companies and  employers to continue to access credit reports even after they are frozen,  among other exceptions.

One general limitation of credit freezes is that they do not protect against  new-account fraud in cases in which credit reports are not used to verify a  consumer’s creditworthiness. Furthermore, credit freezes do not protect  against existing-account fraud, such as fraudulent credit card charges, or  certain other types of fraud, such as identity theft tax refund fraud or  synthetic identity fraud using elements of individuals’ identity information.

While experts with whom we spoke across industry, government, and  consumer groups generally believed credit freezes to be an effective tool  in preventing new-account fraud, some consumer and industry experts  indicated that fraud alerts also can be a good alternative for consumers.  Unlike a credit freeze, a fraud alert still allows companies to access an  individual’s credit report for the purpose of opening a loan or credit  account. Fraud alerts notify companies requesting the reports that the  individual may have been a victim of identity theft. The alerts require  companies to verify consumers’ identities before they issue credit to a  consumer. Fraud alerts therefore can make it harder for an identity thief  to open accounts in a consumer’s name. Moreover, fraud alerts are  easier to place than credit freezes, as consumers only need to contact  one of the three nationwide consumer reporting agencies to place a fraud  alert (that agency is then obligated to contact the other two on the  individual’s behalf). The Economic Growth, Regulatory Relief, and  Consumer Protection Act extended the period of an initial fraud alert from  90 days to 1 year.

However, fraud alerts do not restrict access to consumers’ credit reports  the way freezes do. Therefore, some consumer group and industry  representatives noted that consumers should be aware that a fraud alert  may not offer as strong a protection as a credit freeze does. We did not  find any data or analysis on the effectiveness of fraud alerts compared to  credit freezes or monitoring options. One consumer group told us that it  recommends that after a data breach consumers first place a fraud alert,  because it requires contacting only one of the three nationwide consumer  reporting agencies, and then follow up by placing a credit freeze at the  three agencies.

The three nationwide consumer reporting agencies also offer a product  called a credit lock that is functionally similar to a credit freeze in that it  restricts access to an individual’s credit report. Credit locks do not require  consumers to use a PIN and consumers can turn access to credit reports  on or off through an application on their mobile phone. However, credit  locks are not subject to the same federal requirements regarding the  placement and removal of freezes and therefore do not offer the same  degree of protection to consumers. Instead, credit locks are private  products subject to the consumer reporting agencies’ terms and  conditions, which could change. A credit lock is in place only as long as  the individual subscribes to an agency’s service, but a credit freeze  remains in place until the consumer chooses to remove it. Finally,  consumers may be charged a fee to place a credit lock, whereas credit  freezes can now be placed for free.

Factors Consumers Can Consider When Assessing Options after Data Breaches

Based on our interviews and review of consumer education materials and  our 2017 report, we identified four factors that consumers can consider in  deciding which options are best for them in responding to a breach of  their personal information:

Prevention. Consumers can consider the extent to which an option  might prevent fraud. For example, because credit freezes block all  access to an individual’s credit report, by definition they are effective  in preventing new-account fraud where credit reports are used as part  of the account-opening process. Identity theft services do not prevent  fraud, but detect suspicious activity or help restore identities after  identity theft.

Cost. Consumers can consider the cost of a service. For instance,  consumers can consider whether to pay for commercial identity theft  services if they believe the value of the service outweighs the effort of  monitoring their accounts on their own. In addition, they may consider  that credit freezes now are available for free.

Convenience. Consumers may consider the convenience of a  service. For example, while consumers can monitor their own credit  reports and accounts, some might prefer not to or may be limited in  their ability to do so. In addition, technologies offered through financial  institutions that automatically alert customers to any transactions  involving their accounts can be a convenient, no-cost way for  consumers to monitor their accounts.

Type of information at risk. Finally, several experts from consumer  and industry organizations indicated that the type of option that might  be beneficial would depend on the type of information at risk. For  example, one consumer group representative noted that if a credit  card number were stolen, an identity monitoring service that  monitored the dark web for Social Security numbers might not be  needed. Furthermore, consumers should consider that credit  monitoring will be of limited effectiveness in alerting them to misuse of  an existing credit account—which is more common than fraud related  to setting up new accounts. For more information on consumers’  options, see appendix II.

Federal Agencies Provide Assistance to Consumers Affected by Data Breaches and Identity Theft

Among federal agencies, FTC serves as a primary source for free  assistance (including online resources, educational outreach, and  customized assistance through IdentityTheft.gov) to consumers on ways  to respond to data breaches, identity theft, and related harm.  Approximately 13 percent of those affected by the 2015 OPM breaches  used credit and identity monitoring and identity restoration services that  OPM offered them and a fraction of a percent made identity theft  insurance claims (the payouts for which averaged $1,800). Data we  assessed for this report support a 2017 recommendation we made to the  Office of Management and Budget (OMB) to revise guidance to federal  agencies about responding to data breaches and one to Congress to  consider permitting agencies to determine appropriate levels of identity  theft insurance offered after data breaches.

FTC Is Primary Provider of Federal Assistance to Consumers Affected by Data Breaches and Identity Theft

FTC, as a primary source for assistance to consumers on issues related  to data breaches and identity theft, provides guidance and assistance  through its website and through conferences and workshops.

Online and printed resources. FTC’s home page includes links to  identity theft-related resources, including information about key options  consumers can consider to help them mitigate identity theft risks and  other harms, and a link to IdentityTheft.gov (discussed later in this  section). FTC updates the information regularly, such as after large-scale  data breaches.

Outreach. FTC maintains relationships with state government, law  enforcement, and community and consumer organizations, through which  it conducts outreach about how to respond to exposure or loss of  personal information and identity theft mitigation. For example, FTC  collaborated with the International Association of the Chiefs of Police to  update the association’s model policy for identity theft to include referral  information for IdentityTheft.gov. FTC also has held webinars,  conferences, and workshops on topics related to data breaches and  identity theft for groups including government officials, nonprofits, and the  general public.

Customized assistance (IdentityTheft.gov). FTC provides information  and customized assistance through IdentityTheft.gov to individuals whose  information was lost or stolen or who experienced identity theft or other  harm, such as tax refund fraud. During fiscal year 2018, IdentityTheft.gov  received almost 2 million unique visitors. The website in its current form  has been in place since January 2016 and offers the following types of  assistance:

Steps to take after identity theft. IdentityTheft.gov provides  individual victims with step-by-step instructions to resolve specific  problems. From January 2016 (when FTC launched the current  version of IdentityTheft.gov) through October 1, 2018, approximately  700,000 individuals set up and activated accounts on the website to  help them recover from identity theft. Individuals who set up accounts  can indicate what kind of information was stolen and what kind of  adverse event they experienced. The site helps users generate pre- filled letters, affidavits, and forms to send to consumer reporting  agencies, businesses, debt collectors, and IRS, as appropriate. For  example, individuals who fill out an Identity Theft Report affidavit can  use this report instead of filing a police report to request extended 7- year fraud alerts (available to identity theft victims) on their credit  reports. In addition, individuals who experienced tax refund fraud can  fill out a form on IdentityTheft.gov that is then submitted directly to  IRS. An individual who experienced credit card fraud would be  advised to take different steps than one who experienced fraud  related to utility bills or medical insurance.

Steps to take after data breaches or loss of personal information.

IdentityTheft.gov/databreach provides checklists and suggestions for  people whose personal information was lost or exposed but has not  yet been misused.

FTC also maintains an online chat function and telephone number for  those who need additional assistance. For complex cases, FTC staff may  refer individuals to the Identity Theft Resource Center, a nonprofit  organization.

We found that in developing and updating the website, FTC followed  some key practices for consumer education planning. One key practice  we identified was consulting with stakeholders. According to FTC staff we  interviewed and documentation we reviewed, FTC obtained feedback  from stakeholders such as law enforcement agencies and community  organizations in developing IdentityTheft.gov. Another key practice we  identified was assessing users’ needs. FTC conducted usability testing to  ensure the site’s features were easy to use. FTC staff also told us that  after receiving user feedback, they made it easier for users to set up an  account. FTC also made changes to IdentityTheft.gov—such as  incorporating the ability to auto-generate forms—to implement a 2014  Executive Order calling for federal agencies to centralize identity theft  information at the website. Furthermore, in January 2018, FTC  implemented a new function that allows users who report identity theft tax  refund fraud to file reports directly with IRS. Since its launch in early 2018  through October 1, 2018, almost 22,000 IRS Identity Theft Affidavits (IRS  Form 14039) were submitted to IRS through IdentityTheft.gov. In general,  experts across consumer, government, and industry organizations and  identity theft service providers we interviewed expressed the view that  IdentityTheft.gov is a valuable or user-friendly resource.

Other federal agencies provide assistance to consumers on topics related  to identity theft, including CFPB, the Department of Justice, IRS, and the  Social Security Administration.

CFPB. CFPB enforces, supervises for compliance with, and issues  regulations to implement the federal consumer financial laws that address  certain firms’ and financial institutions’ practices, which may include data  security. A few of these laws and regulations contain provisions that can  help protect the personal information of consumers. CFPB also offers  consumer education resources.

Similarly to FTC, CFPB included information about how consumers can  address risks related to exposure of personal information and recover  from identity theft in the bureau’s overall consumer education activities.  CFPB provides consumer education materials related to data breaches  and identity theft through its blog and its financial education resource,  “Ask CFPB.” CFPB also maintains relationships with external groups,  such as librarian networks. CFPB provides links to FTC resources about  data breaches and identity theft topics on its website, so as not to  duplicate efforts, according to CFPB staff. The two agencies also have  coordinated some efforts. FTC and CFPB published a jointly produced  blog post on September 21, 2018, the date the new free credit freeze and  1-year fraud alert provisions took effect. Such coordination is consistent  with the 2014 Executive Order, which designated FTC as a centralized  source of information about identity theft across the federal government.

Staff of both agencies said that in developing new resources, they  monitor information from a variety of sources, including consumer  complaints, news and social media, and reports from other government  entities, law enforcement, or nongovernmental stakeholders.

Other federal and state agencies. IRS and the Social Security  Administration provide some assistance to consumers for specific types  of identity theft. For example, as noted previously, IRS provides some  taxpayers with PINs if they are victims of identity theft tax refund fraud. In  addition, states enforce laws and regulations and provide consumer  education resources and assistance to consumers at risk of identity theft and other harms as a result of data breaches. For example, the Illinois  Attorney General’s office maintains a call-in number for victims of identity  theft, and the Colorado Bureau of Investigation can assist residents with  identity theft issues.

Few People Used Identity Theft Services OPM Provided, Very Few Made Insurance Claims, and Payouts Received Were Low

OPM offered identity theft services to approximately 22.1 million  individuals whose personal information was compromised during the  2015 data breaches at OPM. Personnel records or OPM systems  containing information from the background investigations of current,  former, and prospective federal employees and other individuals were  breached. The services, offered at no cost to affected individuals,  included credit monitoring, identity monitoring, identity restoration  services, and identity theft insurance. To receive credit and identity  monitoring services, affected people have to enroll with the identity theft  service provider with which OPM contracted, but identity theft insurance  and identity theft restoration services are available to the entire affected  population whether or not they enroll.

Few affected individuals have used the services. According to data from  OPM, as of September 30, 2018, close to 3 million, or 13 percent, of  individuals affected by the 2015 incidents had made use of the services.  As seen in figure 2, the great majority of enrollments occurred in the  months immediately following notification of the breach. OPM staff said  that the spike in enrollments in July and August 2016 likely was due to the  follow-up mailing that OPM sent to approximately 10 percent of affected  individuals whose mailing addresses were incorrect in the original mailing  of notifications.

In addition, according to OPM-reported data we reviewed, of the 3 million  individuals who used the services, about 1 percent made identity  restoration requests and a fraction of 1 percent submitted insurance  claims. According to data we reviewed, approximately 27,000 identity  restoration cases had been resolved as of September 30, 2018. In  addition, 61 insurance claims (of 81 submitted) had been paid, totaling  $112,000, with an average payout of $1,800.

Since 2015, OPM has obligated approximately $421 million for identity  theft services and as of November 30, 2018, OPM paid out approximately  $361 million of the obligated funds. OPM is required to provide identity  theft services through September 2026. The contract to provide these  services on behalf of OPM expired in December 2018; OPM re-competed  and awarded a single contract that month to ID Experts, the company that  had been providing these services.

After the OPM breaches in 2015, OPM provided federal employees and  other affected individuals with information and guidance about their  options in mailed letters and on its website. On its website, OPM  developed a Cybersecurity Resource Center and included background  about the breaches and who was affected; instructions for how to enroll in  identity theft services; and a Frequently Asked Questions webpage that  included links to FTC resources, including IdentityTheft.gov. OMB’s 2017  policy guidance to federal agencies, including OPM, states that agencies  should determine appropriate information to provide to affected  individuals and review breach responses annually. Consistent with that  guidance, OPM’s September 2017 Breach Response Plan calls for the  agency to review its breach response plan annually, including to reinforce  or improve training and awareness. In December 2018, OPM updated its  website to incorporate changes in the cost of credit freezes and duration  of fraud alerts resulting from new legislation we discussed earlier.

OMB Has Not Revised Post-Data Breach Guidance to Agencies and Insurance Coverage Amount for Identity Theft Insurance Remains High

Data we assessed for this report support a 2017 recommendation we  made to OMB and a matter for congressional consideration, both of which  have not yet been implemented. In our March 2017 report, we found  that OMB policy guidance for federal agencies on how to prepare for and  respond to data breaches did not address how agencies might assess the  effectiveness of identity theft services relative to lower-cost alternatives.  For example, the guidance did not discuss whether identity theft services  would be preferable to alternatives (such as fraud alerts, credit freezes, or  the agency conducting its own database monitoring). We concluded that  the guidance might not fully reflect the most useful and cost-effective  options agencies should consider in response to a breach—contrary to  OMB’s risk-management and internal control guidance calling on federal  leaders to improve effectiveness and efficiency. Therefore, we  recommended that OMB conduct an analysis of the effectiveness of  identity theft services relative to alternatives, and revise its guidance to  federal agencies in light of the analysis. In oral comments on a draft of the  2017 report, staff from OMB’s Office of Information and Regulatory Affairs  said that our draft recommendation to OMB on expanding OMB’s  guidance to federal agencies would benefit from greater specificity, and  we revised this recommendation to provide greater clarity.

We contacted OMB several times between May 2018 and early March  2019 to update the status of this recommendation but as of March 2019,  OMB had not responded with an update. In our current review, we found  that information on the effectiveness of various consumer options continues to be limited. We also found that some free and low-cost  alternatives to free or fee-based identity theft services can prevent or  more directly address new account fraud and some options consumers  can take on their own have become less burdensome. Therefore, we  stand by this recommendation.

In addition, as noted previously in this report, the identity theft insurance  that OPM offered to affected individuals resulted in few insurance claims,  and the amounts claimed have been small. These data are consistent  with the findings of our 2017 report—which reported that the number and  dollar amount of claims for identity theft generally were low. They also  reinforce our conclusion that the $5 million per-person coverage limit  mandated by Congress likely was unnecessary and might impose costs  without providing a meaningful corresponding benefit. Specifically, we  noted that $5 million in coverage would increase federal costs  unnecessarily, likely mislead consumers about the benefit of the product,  and create unwarranted escalation of coverage amounts in the  marketplace.

Therefore, we reiterate the matter for congressional consideration we  made in our March 2017 report: in the event that Congress again requires  an agency to provide individuals with identity theft insurance in response  to a breach, it should consider permitting the agency to determine the  appropriate level of that insurance.

We provided a draft of this report to CFPB, FTC, and OPM. The agencies  provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Director of CFPB, the Chair of FTC, and the Acting  Director of OPM. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.

If you or your staff have any questions concerning this report, please  contact me at (202) 512-8678 or ortiza@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report examines (1) information and expert views about the  effectiveness of options consumers can use to prevent or address the  risks resulting from data breaches; and (2) federal assistance available to  help consumers understand these options, including the status of one  matter for congressional consideration and one recommendation relating  to these issues in our 2017 report.

To address the first objective, we conducted a literature review to identify  any studies or independent research on the effectiveness of various  options consumers have for mitigating data breach harms, consumer  attitudes and behavior following data breaches, and identity theft and  other harm to individuals from exposure of personal information. We  searched databases of scholarly publications and other sources for work  generally published within the last 5 years. Examples of databases  searched include ProQuest, EconLit, Policy File Index, and SciTech  Premium Collection. We searched for terms including “effective,” “data  breach,” “identity theft,” “consumer attitudes,” and “consumer behavior”  and options such as “credit freeze,” “fraud alert,” and “credit lock.” We  also reviewed relevant academic literature to identify additional studies.  From these searches, we did not identify any studies that assessed the  extent to which commercial identity theft services were effective in  preventing or mitigating harm from exposure of personal information. We  identified and reviewed 54 studies that appeared in peer-reviewed  journals or research institutions’ publications and were relevant to  consumer attitudes and behavior related to privacy, data breaches, and  identity theft.

To ensure the selection of a range of perspectives on the effectiveness of  options to mitigate harms, we reviewed the selection of experts and  sources in our prior report and our literature review, and updated that  selection through additional searches and recommendations from  discussions with experts and identity theft service providers and review of  relevant literature. We defined experts as those representing consumer  and industry policy organizations that have conducted research or taken  policy positions on consumers’ or entities’ options after data breaches;  academics who conducted research on relevant topics; and federal and  state government staff with specific positions of responsibility in consumer  protection or education. We also contacted seven companies that provide  identity theft services to consumers.

We interviewed representatives of a nongeneralizable sample of 35  entities in the following categories: academic or independent research  institution (4); consumer or privacy research and advocacy (10); industry  association, identity theft service provider, or industry consultant (12); and  federal or state government (9). We also reviewed relevant consumer  education and other materials produced by consumer, government,  industry, and other entities. We interviewed academics from Carnegie- Mellon University, RAND Corporation, the University of Maryland, and the  University of Rochester. In addition, we interviewed representatives from  the following organizations:

Consumer or privacy groups: AARP, Consumer Action, Consumer  Federation of America, Consumer Reports, Electronic Privacy  Information Center, Identity Theft Resource Center, National  Consumer Law Center, Privacy Rights Clearinghouse, U.S. PIRG,  and World Privacy Forum.

Industry associations or consultants: American Bankers  Association, Consumer Data Industry Association, Property and  Casualty Insurers Association of America, National Retail Federation,  and Rational 360.

Identity theft service providers: Credit Karma, Equifax, Experian, ID  Experts, ID Shield, LifeLock, and TransUnion.

Government agencies: Consumer Financial Protection Bureau  (CFPB), Federal Reserve Bank of Philadelphia, Federal Trade  Commission (FTC), Office of Personnel Management (OPM), and  Offices of the Attorney General of California, Connecticut, Illinois,  Massachusetts, and New York.

Throughout this report, we use certain qualifiers when describing  responses from interview participants and views of entities whose articles  and written material we reviewed, such as “few,” “some,” and “most.” We  define few as a small number such as two or three. The specific  quantification of categories depends on the overall numbers of entities  that addressed a specific topic. For example, we may refer to views  shared by a proportion of the 10 consumer groups we interviewed, or  those shared by identity theft service providers.

We also reviewed provisions in the Economic Growth, Regulatory Relief,  and Consumer Protection Act, enacted in May 2018, that address credit  freezes and fraud alerts (two tools for preventing new-account fraud).

To address the second objective, we reviewed and analyzed  documentation and interviewed staff from FTC, CFPB, and OPM. We  reviewed and analyzed FTC, CFPB, and OPM consumer education  materials including blog posts, online fact sheets, and printed brochures  and data on usage of the materials. For example, we analyzed FTC,  CFPB, and OPM data and website analytics for their data breach- and  identity theft-related web pages. We interviewed FTC and CFPB agency  staff about their assistance to individuals and how they measure  effectiveness of their efforts. We reviewed documentation and interviewed  agency staff about the development, implementation, and assessment of  consumer education materials and other resources and assistance. For  example, we reviewed materials documenting FTC’s outreach to  stakeholders and usability testing of IdentityTheft.gov. We compared the  activities against a 2014 Executive Order on the security of consumer  financial transactions, key practices for consumer education planning we  identified in prior work, and federal standards for internal control.

We analyzed data from the company with which OPM contracted to  provide identity theft services to the approximately 22.1 million individuals  whose information was exposed in the 2015 data breaches. We obtained  data on the number of enrollments, the number and size of identity theft  insurance claims submitted and paid, and number of identity restoration  cases the companies handled. We assessed the reliability of the data by  interviewing agency officials and reviewing documentation about the  systems used to store the data. We found the data to be reliable for  purposes of this reporting objective. We also reviewed the online  guidance OPM provided to affected individuals and assessed the  guidance against Office of Management and Budget guidance for  agencies following data breaches and OPM’s 2017 Breach Response  plan.

In addition, for both objectives, we reviewed the evidence gathered and  analyzed for the 2017 GAO report (GAO-17-254) and updated the status  of the matter for congressional consideration and recommendations made  in that report.

Appendix II: What Can Consumers Do After a Data Breach?

Appendix II: What Can Consumers Do After a  Data Breach?

Figure 3 below provides information on actions consumers can take to  monitor for identity theft or other forms of fraud, protect their personal  information, and respond if they have been a victim of identity theft. This  information summarizes prior GAO work and comments of academic,  consumer organization, industry, and government experts.

Appendix III: GAO Contacts and Staff Acknowledgements

In addition to the contact named above, Kay Kuhlman (Assistant  Director), Meghana Acharya, Carl Barden, Bethany Benitez, Catherine  Gelb (Analyst in Charge), Danielle Koonce, Jill Lacey, Kathleen  McQueeney, Barbara Roesmann, Jena Sinkfield, and Meg Tulloch made  significant contributions to this report.

Data breaches have exposed the personal data of hundreds of millions of people and put them at risk for identity theft.

We looked at what you can do if you're a victim of a data breach. Identity theft services can be convenient, but they don't prevent fraud from happening in the first place.

There are also some steps you can take on your own for free—such as freezing your credit reports. A freeze prevents the opening of new credit accounts or loans in your name.

We've previously recommended that Congress reconsider legislation requiring federal agencies to offer high levels of identity theft insurance coverage.