Lifelock's Lost Combination

Court: Lifelock Using 'Unfair Business Practice' -The Red Tape Chronicles

Back in April 2008, APRPEH posted: Lifelock Getting Picked. At that time, Lifelock and its over-exposed CEO Todd Davis was at the beginning of a slew of legal issues. Well finally, the Experian case may have hammered the first nail into the coffin of Lifelock. According to the above story, Lifelock's procedure of proactively placing fraud alerts is an "unfair business practice". U.S. District Judge Andrew Guilford of the Central District of California ruled that

"Experian clearly incurs costs each time it must process a fraud alert made by LifeLock. These costs include the costs of allocating Experian’s electronic resources and employee time, plus the maintenance costs of Experian’s toll-free telephone number and Web page used to accept fraud alert requests," he said. "Experian also incurs postage and printing costs in mailing disclosure letters to each consumer on whose behalf a fraud alert is requested."

As was pointed out in the article, Lifelock will continue to place 90 day security alerts either with Trans Union or Equifax which pursuant to the Fair Credit Reporting Act, will also be automatically activated with Experian too. The big question is whether or not Trans Union and/or Equifax will press the issue and request Lifelock to stop automatically placing and renewing security alerts as well. Or, will either Trans Union or Equifax cut a deal with Lifelock? If I were forced to guess on this, I would expect both Equifax and Trans Union (which has worked with Lifelock in the past) to cut a deal provided there is adequate financial reason for the bureaus to do so. Lifelock claims that if they are prevented from performing their primary offering of automatically renewing security alerts they will continue to provide other services.

Lifelock's other services, besides the security alert include an internet privacy scan service and "Wallet Lock" which amounts to someone asking you, with apologies to Capital One, "Whats in your Wallet?" in the event you lose it and "help you contact each credit card, bank or document issuing company, cancel your affected accounts and complete the paperwork and steps necessary to replace your lost documents, including your credit/debit cards, driver's license, social security card, insurance cards, checkbook - even travelers checks...". Plenty of other companies offer internet scans and I suppose if you are not near a computer it is helpful to have someone look up telephone numbers and possibly conference call you in to the customer service of your credit card issuer.

Despite Lifelock's tremendous advertising effort, the product has always been lacking substance. As a result of this, Lifelock entered the business world with a guarantee and promise which they could never keep. While the product expectations, after much criticism were finally revised to more realistic levels, the question of why purchasing the coverage remained. The question now is still pressing. While the bureaus may force Lifelock from performing automatic security alert renewals, the bureaus would most certainly fail in an attempt to prevent consumers from doing the same proactively. Why continue to pay $10 a month for internet scanning and "Wallet lock"?

What is true is that other companies in the business of providing security services to consumers, those who provide honest and useful services to consumers, will read this story with a smirk. Lifelock's history of high-flying promises and service guarantee, both of which have been, in my opinion a stain on the industry coupled with the high profile advertising, - are not enviable but embarrassing. The most important question is what will all of our favorite radio talk shows do if Lifelock stops its radio advertising campaign?

Lifelock's Todd Davis: Identity for Sale

Fraud-prevention pitchman becomes ID theft victim

CNN via AP

Story Highlights:

• Man reportedly obtained loan using Social Security number of LifeLock spokesman


• Todd Davis regularly gives out Social Security number in ads for ID security company


• Customers file lawsuit, claiming Lifelock did not provide protection as advertised

SAN JOSE, California (AP) -- Todd Davis has dared criminals for two years to try stealing his identity: Ads for his fraud-prevention company, LifeLock, even offer his Social Security number next to his smiling mug.

Now, LifeLock customers in Maryland, New Jersey and West Virginia are suing Davis, claiming his service didn't work as promised and he knew it wouldn't, because the service had failed even him.

Attorney David Paris said he found records of other people applying for or receiving driver's licenses at least 20 times using Davis' Social Security number, though some of the applications may have been rejected because data in them didn't match what the Social Security Administration had on file.

Davis acknowledged in an interview with The Associated Press that his stunt has led to at least 87 instances in which people have tried to steal his identity, and one succeeded: a guy in Texas who duped an online payday loan operation last year into giving him $500 using Davis' Social Security number.

Paris said the fact Davis' records were compromised at all supports the claim that Tempe, Arizona-based LifeLock doesn't provide the comprehensive protection its advertisements say it does.

"It's further evidence of the ineffectiveness of the services that LifeLock advertises," said Paris, who is lead attorney on the three new lawsuits, the latest of which was filed this month.

Davis learned about the fraud in Texas when the payday-loan outfit called to collect on the loan, he said. He didn't get an alert beforehand because the company didn't go through one of the three major credit bureaus before approving the transaction.

Davis said it's possible driver's licenses have been issued to other people in his name because of the widespread availability of his personal information -- and because of what he described as the flimsy mechanisms in place to report that kind of fraud.

Paris noted that LifeLock charges $10 a month to set fraud alerts with credit bureaus, even though consumers can do it themselves for free.

But Davis stands by his company and his advertising gimmick, which has appeared in newspapers and on billboards, radio and MTV. He even broadcasts it by bullhorn on walking tours through crowded downtowns.

"There's nothing on my actual credit report about uncollected funds, no outstanding tickets or warrants or anything," he said. "There's nothing to indicate my identity has been successfully compromised other than the one instance. I know I'm taking a slightly higher risk. But I'll take my risk for the tremendous benefit we're bringing to society and to consumers."

The lawsuits, for which Paris is seeking class-action status, highlight the fundamental limits on how much security identity-theft companies can provide.

Companies like LifeLock can help guard against only certain types of financial fraud by helping consumers set up alerts with credit bureaus, which inform them when someone tries to open a new line of credit or boost their credit limit to finance a buying binge, for example.

The services don't guard against many types of identity theft such as use of a stolen Social Security number on a job application or for medical services, or even the instance of an arrestee giving police a stolen Social Security number to shield his own identity.

LifeLock is also being sued in Arizona over its $1 million service guarantee, which the plaintiffs claim is misleading because it only covers a defect in LifeLock's service, and in California by the Experian credit bureau. Experian accuses LifeLock of deceiving consumers about the breadth of its protection and abusing the system for attaching fraud alerts to credit reports.

Security experts say complaints about the company reinforce the time-honored wisdom of keeping your Social Security number secret.

"There's been a lot of marketing, a lot of hype about LifeLock," said Paul Stephens, director of policy and advocacy with the Privacy Rights Clearinghouse, a nonprofit consumer advocacy organization. "The question is, 'How much protection does it really buy you?"'

"There is no company that can guarantee they can protect you (completely) against identity theft," Stephens said. "Absolutely nobody can do that."

---

"There's nothing on my actual credit report about uncollected funds, no outstanding tickets or warrants or anything," he said. "There's nothing to indicate my identity has been successfully compromised other than the one instance. I know I'm taking a slightly higher risk.

Have you ever seen such a self serving comment as this? "My identity" is safe, nevermind the fouled up records of state DMVs, the inaccurate records and safety concerns of who knows how many illegally licensed drivers acquired a motor vehicle operator's license using the PII of Todd Davis, creep in chief of Lifelock. Whether it is illegal workers or terrorists or felons, Todd Davis's lust for competitive greed has served well the needs of the "bad guys", perpetrators of identity theft seeking to skirt the law to illegally obtain motor vehicle operator permits.

Then he has the audacity to say:

But I'll take my risk for the tremendous benefit we're bringing to society and to consumers."

I hope Lifelock customers are carefully watching how callous and cavalier the creep in chief of Lifelock is concerning the law of the land. APRPEH has discussed the mis-adventures of Lifelock in previous posts and pointed out that the fraud alert will cure all hysterics will not prevent identity theft and should never be considered blanket protection against identity theft. Based upon the article above, the word may be getting out now that identity theft is more than credit accounts:

Companies like LifeLock can help guard against only certain types of financial fraud by helping consumers set up alerts with credit bureaus, which inform them when someone tries to open a new line of credit or boost their credit limit to finance a buying binge, for example.

The services don't guard against many types of identity theft such as use of a stolen Social Security number on a job application or for medical services, or even the instance of an arrestee giving police a stolen Social Security number to shield his own identity.

To all those companies out there selling services similar to what Lifelock does, and there are plenty of others, I say watchout, a class action suit is coming your way. A simple reading of paragraph 605A of the Fair Credit Reporting Act using the logic of a layman will render that fraud alerts are for intended for "the consumer{that} has been or is about to become a victim of fraud or related crime, including identity theft.." and for their protection:

a user of such consumer report shall contact the consumer using that telephone number or take reasonable steps to verify the consumer's identity and confirm that the application for a new credit plan is not the result of identity theft.

The whole subsection is below or see the FCRA in it's entirety. Anyone selling fraud alerts as the way to guarantee protection against identity theft is a fraud.

To recap, there are two main problems with the Lifelock approach:
1) credit issuers do not have to make a telephone call to verify the credit application
2) only about 20%-25% according to the FTC of all identity theft will be reported to a credit bureau meaning the fraud alert will not be read and no verification of the consumer's interest in the transaction, whatever transaction it might be, will be made.

FCRA 605A
(B) Limitation on Users
(i) In general. No prospective user of a consumer report that includes an
initial fraud alert or an active duty alert in accordance with this section
may establish a new credit plan or extension of credit, other than under
an open-end credit plan (as defined in section 103(i)), in the name of
the consumer, or issue an additional card on an existing credit account
requested by a consumer, or grant any increase in credit limit on an
existing credit account requested by a consumer, unless the user
utilizes reasonable policies and procedures to form a reasonable belief
that the user knows the identity of the person making the request.
(ii) Verification. If a consumer requesting the alert has specified a
telephone number to be used for identity verification purposes, before
authorizing any new credit plan or extension described in clause (i) in
the name of such consumer, a user of such consumer report shall
contact the consumer using that telephone number or take reasonable
steps to verify the consumer's identity and confirm that the application
for a new credit plan is not the result of identity theft.

previous APRPEH Id theft articles related to Lifelock:

Lifelock Brainblock Lifeblock Brainlock
Lifelock Getting Picked
Identity Protection Shopping
Minors and Identity
As G. Gordon Liddy Would Say..Suckers

Lifelock Getting Picked

Lifelock Getting Picked

Since February 2008, Lifelock, the company that guarantees that your identity will not be stolen has been hammered by legal problems. Lifelock charges consumers $10 a month for the privilege of allowing the company to manage your Fair Credit Reporting Act right to a free initial security alert and which automatically opts out a consumer from pre-approved credit offers for six months. The Lifelock website states:

LifeLock, the industry leader in proactive identity theft protection, offers a proven solution that prevents your identity from being stolen before it happens. We'll protect your identity and personal information for only $10 a month - and we guarantee our service up to $1,000,000. Lifelock website

A consumer must know what it is they are shopping for and buying. Part of the education of the consumer comes from the vendors or retailers where the consumer shops. Lifelock, as quoted above claims that their product “prevents your identity from being stolen before it happens”. Prevents? Come again? It would make sense to say, in the careful speech of legalese, “reduces the likelihood of identity theft” or “works to protect your identity”. The word “prevents” clearly implies a non-conditional protection. A consumer reading this, if he or she is able to overcome their natural inclination to say “too good to be true” might jump at the opportunity to purchase such protection.

But can Lifelock truly prevent your identity from being stolen. Three legal actions aimed at Lifelock beg to differ. First, on February 13, 2008, the Montana Attorney General, Mike McGrath opened a civil investigation of Lifelock based upon the appearance of CEO Todd Davis’s Social Security Number in a full page advertisement in the Great Falls Tribune. Assistant Attorney General Jesse Laslovich is quoted as saying in an article in the same newspaper “… there also are some businesses cropping up that may only claim to protect people from identity theft”, pointing out the nature of Lifelock’s business is the utilization of no-cost initial security alert placed on the credit file by the three credit repository agencies upon request. An additional concern implied by the Attorney General is that the advertisement including Davis’s Social Security Number may itself be contributing to attempted identity fraud, “The Social Security number in the advertisement is registered to numerous people, Laslovich said. Thats probably because people see it and try to use it to open lines of credit, he added.” Great Falls Tribune

Lifelock’s second blow came from the credit repository Experian filing a civil suit in the Federal District Court of Central California announced on February 21. press release

Experian’s suit alleges that Lifelock is abusing the Fair Credit Reporting Act right to an initial security alert, essentially comparing the use of the alert in a permanent fashion to crying wolf. The Fair Credit Reporting Act states in § 605A (a)(1) that “… a suspicion that the consumer has been or is about to become a victim of fraud or related crime, including identity theft,…” is the definition of an initial alert’s purpose. FCRA text.

Experian also claims that Lifelock’s advertising is “false and misleading.” Another claim is that Lifelock’s ordering of credit reports for it’s customers (which are provided free of charge according to the Fair Credit Reporting Act when requesting an initial fraud alert, § 612. Charges for certain disclosures (d) Free disclosures in connection with fraud alerts ) is being conducted “without adequate disclosure”, meaning that consumers are unaware or are not told by Lifelock that the credit reports they receive are provided free by the credit repositories per federal law. Experian goes on to claim that companies are not legally able to place the fraud alerts for consumers which seems to be a stretch provided that consumers are authorizing the company to do so.

Experian’s most pertinent complaint involves the applying of initial fraud alerts without the imminent fear of or possibility of fraud. The credit bureau’s argument is that the protective nature of an initial security alert will be diminished if the alerts become too common place. Experian argues that creditors will essentially be forced to treat every initial alert as equal implying that eventually the alerts will be ignored.

Lifelock is counting on the practice that creditors will always place a telephone call to the consumer upon discovering the initial security alert. However, The Fair Credit Reporting Act does not require a creditor to make a telephone call to the consumer every time an initial security alert is found, but is permitted to “ take reasonable steps to verify the consumer's identity and confirm that the application for a new credit plan is not the result of identity theft” meaning that it is possible that the use of database to verify the personal identifying information of the consumer probably suffices to meet the requirements of the law. If the database does not reflect new fraudulent activity, the alert may not work. Another possibility is to mail a letter to the consumer. Experian seems to have a good point.

Fair Credit Reporting Act

§ 605A. Identity theft prevention; fraud alerts and active duty alerts [15 U.S.C. §1681c-1]

(h) Limitations on Use of Information for Credit Extensions

(1) Requirements for initial and active duty alerts-

(B) Limitation on Users

(ii) Verification. If a consumer requesting the alert has specified a

telephone number to be used for identity verification purposes, before

authorizing any new credit plan or extension described in clause (i) in

the name of such consumer, a user of such consumer report shall

contact the consumer using that telephone number or take reasonable

steps to verify the consumer's identity and confirm that the application

for a new credit plan is not the result of identity theft.

Lastly, on 28 March 2008 a class action suit was filed in Arizona against Lifelock alleging similar claims as the Experian suit:

The lawsuit alleges that the three-year-old company defrauds customers by offering services it cannot legally perform, and by touting a $1 million guarantee that the suit alleges is wildly misleading. press release

The class action suit based upon Arizona's Consumer Fraud Act and the Arizona Insurance Code alleges that Lifelock misleads the consumer by overstating the protection it affords and reiterates the Experian claim that Lifelock cannot legally order the consumer’s credit report. The class action suit also calls into question the highly advertised $1,000,000 guarantee. The press release reports that the guarantee’s actual language is:

LifeLock will not pay any losses directly to the consumer and does not cover consequential or incidental damages to identity theft. The guarantee is limited to fixing failures or defects in the LifeLock services and paying other professionals to attempt to restore losses.

So a consumer who does become a victim of identity theft at the very least can claim remuneration from Lifelock for professional identity restoration services, something that could have been purchased on a monthly basis for not too much more than Lifelock’s $10 fee from competitors of Lifelock.

Will Lifelock survive this legal onslaught? Are more suits or investigations coming? Only time will tell. What is for certain is that Lifelock’s attorneys are going to be very busy in 2008. Lifelock continues to secure funding from prominent industry financial leaders such as Goldman Sachs Group Inc most recently $25 million in January 2008. BizJournal. How much of this last funding round will be spent in legal fees or payouts remains to be seen.

Lifelock Brainblock, Lifeblock, Brainlock

McGrath probing service preventing identity theft
By ERIN MADISON
Tribune Staff Writer

The Montana Attorney General's office is investigating LifeLock, a company profiled in Sunday's Tribune.

LifeLock is an identity theft prevention service. Customers pay $10 per month to have a fraud alert placed on their credit reports and be opted out of pre-approved credit card offers. If one of LifeLock's members has their identity stolen, the company covers any losses up to $1 million.

LifeLock previously ran a full-page ad in the Tribune, which included the Social Security number of the company CEO Todd Davis.

That ad piqued the interest of Attorney General Mike McGrath, said Assistant Attorney General Jesse Laslovich.
"When that ad appeared, we started investigating them," Laslovich said, adding that so far nothing has come of the investigation.

The attorney general's office is sending the company a notice of a civil investigation, Laslovich said.

LifeLock is not aware of any state investigation, said Tami Nealy, director of communications for the company.

When McGrath saw Davis' Social Security number in the advertisement, he had concerns that it wasn't actually the CEO's Social Security number, Laslovich said.

Davis says he can give out his Social Security number because LifeLock is effective in preventing anyone from using it to commit fraud.

The Social Security number in the advertisement is registered to numerous people, Laslovich said. That's probably because people see it and try to use it to open lines of credit, he added.

The number in the advertisement is Davis' real Social Security number, Nealy said. Davis gets calls via the LifeLock service every two or three weeks notifying him that people are trying to open lines of credit in his name.

Every time the company prints Davis' Social Security number, it also gives a disclaimer saying people should protect their Social Security numbers and not share them, Nealy added.

The attorney general's office also has concerns about LifeLock because most of the services it offers are things people can do for free on their own, Laslovich said.

The company doesn't deny that, Nealy said.

"Everything we do for you, you can do yourself," she said.

However, the company offers convenience in that members don't have to do those things themselves, such as renew fraud alerts, which expire every 90 days.

"You can change your own oil; you just don't," Nealy said.

Laslovich recommends that people do thorough research before signing up with LifeLock — look over the contracts before signing them, be sure to understand what the company offers and go over everything with a fine-tooth comb.

Laslovich noted that with the increase in identity theft, there also are some businesses cropping up that may only claim to protect people from identity theft.

"We're just trying to be proactive," he said.

Reach Erin Madison at 791-1466, 800-438-6600 or emadison@greatfallstribune.com.

---

APRPEH has posted information and analysis concerning Lifelock in the past: here and here. Lifelock at least is honest in admitting that the services they provide can be done for free by anyone. The analogy of changing the car oil doesn't really apply. A fraud alert can be placed on all three credit files in under 3 minutes, faster if you are familiar with the touchpad sequence. Both Experian's and Equifax's websites are set up to take the alert online. This a very simple process with very little risk of a leaving your garage a filthy mess and your fragile male ego shattered. More troublesome is the Lifelock marketing:

LifeLock, the industry leader in proactive identity theft protection, offers a proven solution that prevents your identity from being stolen before it happens. We'll protect your identity and personal information for only $10 a month - and we guarantee our service up to $1,000,000. We also offer the only identity theft child protection program available in the market, so guarantee your good name today and enroll now.

Fraud alerts are only affective in preventing credit based fraud. Any new account opening or transaction where a credit report is not necessary by-passes the fraud alert protection. Utility companies for instance including many telecommunications and internet service providers rarely if ever utilize a credit report for new account openings.

The same claims about safety have been made by the credit freeze advocates. APRPEH discussed the credit freeze issue in November.

The Lifelock marketing brags about selling "the only identity theft child protection program available in the market." Why is that?

Lifelock claims:

Among the things we do:

• We check credit reports every 6 months to ensure that there is no activity.


• If a credit report does exist, we place fraud alerts on credit reports, stating that this is a minor child and that no activity should occur.


• We check for work history and any misuse of the Social Security number.


• We repeat this process regularly to ensure that all is well.


• Starting out is hard enough. Starting out with a stolen Identity makes it ten times harder. We think that's worth $25 a year. Do you?

APRPEH discussed the issues involving minors and their Social Security Numbers and Minors and Identity last year as well.

A good question for Attorney General Mike McGrath to ask is exactly what protecting is Lifelock doing? The product described on their website merely goes the process of determining if fraud has occurred using a minor's personal identifying information. To find out if a credit report exists for a minor, follow the instructions available from the Identity Theft Resource Center. In general, the credit bureaus will not knowingly produce and report credit history associated with a minor. Once the bureaus are aware that a credit file is associated with a minor they will either freeze the file or mark it accordingly. What the bureaus consider a minor is a different matter. A teen who is listed as an authorized user on a credit card likely has a credit file. Expecting a consistent answer from the bureaus as to why one minor should have a file and another shouldn't is asking for too much.

Wishing Good luck to General McGrath.