Last reviewed: 1 October 2026

Home › Credit help › Credit monitoring & ID theft protection

Credit monitoring and identity theft protection services, explained

Some consumers use credit or identity protection services believing they will protect them against identity theft before it can happen; the CFPB says that is not the case. What a monitoring subscription actually does is narrower than that, and a real share of what it does do is already available free, through rights this site covers elsewhere. Knowing exactly where the free version ends and a paid plan's real added value begins — and what neither one alerts you to — matters more than which specific product you'd pick.

Three different products, sold together

"Credit monitoring and identity theft protection" is usually a bundle of three separate things. Credit monitoring watches one or more of your three credit files and lets you know when something changes — a new account, a company checking your credit history, a change in your credit limit. Identity monitoring is broader: it checks databases that collect other kinds of information about you, including websites identity thieves use to trade stolen information, often called "dark web monitoring." Identity theft insurance is a separate reimbursement product, sometimes bundled in, that pays specific out-of-pocket costs if you do become a victim. All three are legitimate categories of product. None of them is the same thing as "identity theft can't happen to you."

How much of this is already free

Before evaluating a paid plan, it's worth knowing what federal law and the three bureaus already give you at no cost, since a lot of a monitoring subscription's core function overlaps with it directly:

• A free credit report from each bureau, every week. Equifax, Experian, and TransUnion made permanent, in September 2023, the weekly free-report access they'd offered since the pandemic — see our explainer on the free-report right and the imposter sites built around it for the one legitimate site that provides it.
• A free security freeze, at all three bureaus. The FTC says there is no cost to place or lift a freeze, and that while one is in place nobody can open a new credit account in your name. The CFPB says most monitoring services do not protect your personal information from being stolen and merely alert you after it has been stolen. A free fraud alert makes lenders verify your identity before they grant new credit. See our explainer on freezes, locks, and fraud alerts for the mechanics and the deadline to lift a freeze.
• A free federal recovery tool if something does happen. IdentityTheft.gov, run by the Federal Trade Commission, gives you a free personal recovery plan; the FTC says you can print pre-filled letters and forms to send to credit bureaus, businesses, and debt collectors.

What a paid plan adds on top of all this depends on what it includes. The FTC suggests asking how often it checks credit reports, which of the three bureaus it monitors, and whether other services such as a credit score are included, and reminds you that you can monitor your credit by getting your free credit reports. Insurance and identity-monitoring features are covered below.

"Dark web monitoring": what identity monitoring alerts on

"Dark web monitoring," as it is often called, falls under identity monitoring. The FTC says identity monitoring services check databases for new or inaccurate information about you — including things that might not show up on your credit report — and may tell you when your information shows up on websites that identity thieves use to trade stolen information, or in a change-of-address request, court or arrest records, or an application for a payday loan. That is a real function, but the FTC also says most identity monitoring services will not alert you if someone uses your information to file a tax return and collect your refund, or to get Medicare, Medicaid, or welfare benefits, claim Social Security benefits, or claim unemployment benefits. If your identity is stolen, the NAIC lists steps to take, including changing your passwords, contacting your financial institutions, and locking or freezing your credit report with each of the three major bureaus.

What monitoring may not alert you to

This is the gap most worth understanding: some kinds of identity theft fall outside what these services alert on:

• Money taken from your bank account. The FTC says credit monitoring services will not alert you when someone withdraws money from your bank account.
• Tax refund identity theft — someone filing a tax return with your Social Security number to collect your refund. The FTC says credit monitoring will not alert you to it, and that most identity monitoring services will not either.
• Government benefits claimed in your name. The FTC says most identity monitoring services will not alert you if someone uses your information to get Medicare, Medicaid, or welfare benefits, claim Social Security benefits, or claim unemployment benefits.

Separately, the Federal Reserve's 2019 white paper describes synthetic identity fraud: fraudsters creating a new identity, including by combining real and fake personal information. It says that when a credit inquiry is made for that identity it creates a credit file for it. The paper does not discuss consumer credit or identity monitoring.

The insurance rider: what it actually pays for

Identity theft insurance, whether sold standalone or bundled into a monitoring plan, is built to reimburse the cost of the recovery process. The FTC lists out-of-pocket expenses such as copying documents, postage, getting documents notarized, wages you lost, and legal fees you paid; the NAIC lists legal fees, lost wages, and administrative expenses. The NAIC advises asking what a policy includes and excludes, its deductible, and its coverage limits; the FTC advises asking about the deductible and what is covered. What it generally does not reimburse, according to both the FTC and the NAIC, is money stolen from your accounts. That distinction matters because federal law already caps your exposure to stolen money: a lost or stolen credit card's unauthorized charges are capped at $50 under the Truth in Lending Act — see our explainer on credit card billing disputes for that cap and the parallel, tiered rule for a debit card under the Electronic Fund Transfer Act. An insurance rider is filling a gap in the cost of recovery, not standing in for protections that already exist for the money itself.

What this doesn't mean

None of the above is a verdict that a paid plan is worthless — for someone who'd genuinely rather not manage freezes at three separate bureaus, track a weekly free report, or draft their own recovery letters after a breach (if the plan includes recovery services), the convenience a paid plan bundles together is a real trade-off, not a scam. It's worth making that trade-off with an accurate picture of what's already free, what a subscription actually adds on top of it, and which kinds of identity theft — tax, benefits, bank-account withdrawals — a credit or identity monitoring service may not alert you to.

Correction, 1 October 2026: the references and several statements in this guide were corrected to match their sources. Reference entries: the FTC IdentityTheft.gov reference now carries the title and date of the FTC press release it describes (28 January 2016); the FTC, CFPB, NAIC, and Federal Reserve references now state only what each source says; a CDIA news post and the Federal Reserve Banks white paper are named as the documents they are; and two references were added (an FTC and a CFPB page). Body: the opening paragraph, the insurance coverage description, the dark web monitoring paragraph, the list of what monitoring does not alert on, the synthetic identity passage, and the freeze and IdentityTheft.gov descriptions were reworded to what the FTC, CFPB, NAIC, and Federal Reserve sources state. Removed as unsupported: the "since 2018" and "one-hour deadline" freeze details, the claim that "zero liability" policies go further than the statutory caps, the medical identity theft item, and the "mostly convenience" paragraph. The guide's overall conclusions are unchanged.