Credit monitoring and identity theft protection services, explained

A monthly monitoring subscription is sold as a general shield against identity theft. What it actually does is narrower than that pitch, and a real share of what it does do is already available free, through rights this site covers elsewhere. Knowing exactly where the free version ends and a paid plan's real added value begins — and where neither one can see the problem at all — matters more than which specific product you'd pick.

Three different products, sold together

"Credit monitoring and identity theft protection" is usually a bundle of three separate things. Credit monitoring watches one or more of your three credit files for new activity — a new account, a hard inquiry, a big balance change — and alerts you after it happens. Identity monitoring is broader: it also scans for your Social Security number, email addresses, or account credentials showing up in breach data or on forums associated with stolen-data trading, sometimes called "dark web monitoring." Identity theft insurance is a separate reimbursement product, often bundled in as a rider, that pays specific out-of-pocket costs if you do become a victim. All three are legitimate categories of product. None of them is the same thing as "identity theft can't happen to you," which is closer to how they're often marketed.

How much of this is already free

Before evaluating a paid plan, it's worth knowing what federal law and the three bureaus already give you at no cost, since a lot of a monitoring subscription's core function overlaps with it directly:

A free credit report from each bureau, every week. Equifax, Experian, and TransUnion made permanent, in September 2023, the weekly free-report access they'd offered since the pandemic — see our explainer on the free-report right and the imposter sites built around it for the one legitimate site that provides it.
A free security freeze, at all three bureaus, since 2018. A freeze blocks a new creditor from opening an account in your name at all — a stronger protection than an after-the-fact alert — and a free fraud alert requires extra identity verification even without a full freeze. See our explainer on freezes, locks, and fraud alerts for the mechanics and the one-hour deadline to lift a freeze.
A free federal recovery tool if something does happen. IdentityTheft.gov, run by the Federal Trade Commission, generates a personalized recovery plan, pre-fills the letters and the FTC Identity Theft Affidavit you'd otherwise have to draft yourself, and walks through reporting to the specific creditors and bureaus your case involves — at no cost, regardless of whether you have any paid product at all.

A paid plan's realistic added value on top of all this is mostly convenience — one dashboard instead of three separate bureau logins, and monitoring across all three files by default rather than one at a time — plus whatever identity-monitoring and insurance features it bundles in, covered below.

"Dark web monitoring": what it actually scans

A dark web or "dark web monitoring" feature works by continuously checking known data-breach dumps and forums where stolen credentials and personal information circulate, then alerting you if your own SSN, email, or account details turn up in one. That's a real, useful function — but it has two structural limits worth knowing before it's sold as comprehensive surveillance of "the dark web": no service can scan every private forum, marketplace, or encrypted channel where stolen data moves, so a hit means your information has been found somewhere, not that a miss means it's nowhere; and finding your data already circulating doesn't remove it or undo the original breach — the alert tells you to act (freeze your credit, change the exposed password, watch the affected account), it doesn't act for you.

What credit-based monitoring structurally can't see

This is the gap most worth understanding, because it's not a matter of picking a more thorough plan — some kinds of identity theft simply don't touch a credit file at all, or touch it in a way ordinary monitoring isn't built to catch:

Medical identity theft — someone using your identity to obtain treatment or prescriptions — shows up in insurance and provider billing records, not a credit bureau file, unless and until an unpaid medical bill is eventually sent to collections.
Tax refund identity theft — someone filing a fraudulent return in your name to claim your refund — is caught by the IRS's own fraud filters or by your own return being rejected as a duplicate, not by anything a credit bureau tracks.
Unemployment and public-benefits fraud — a documented, large-scale pattern especially since 2020 — runs through state benefits agencies, entirely outside the credit-reporting system.
Synthetic identity fraud is the sharpest gap of all: rather than taking over your existing file, a fraudster pairs your real Social Security number with a fabricated name, birthdate, and address. The Federal Reserve's own 2019 analysis of the problem describes the typical result as an entirely new credit file being opened around that SSN-name combination — one that was never yours to begin with, and that ordinary monitoring of your existing file has no reason to flag, since nothing on your own file changed at all.

A freeze and a monitoring subscription both share this same blind spot. Neither one watches for a brand-new file built around your SSN under a name that isn't yours — a freeze blocks new activity on your own file, and monitoring watches your own file for changes. Catching synthetic fraud generally depends on the original data breach being caught upstream, or on the fraudulent file eventually surfacing through a collections notice, a data match at the Social Security Administration, or a lender's own synthetic-fraud screening — not on any consumer-facing product available today.

The insurance rider: what it actually pays for

Identity theft insurance, whether sold standalone or bundled into a monitoring plan, is built to reimburse the cost of the recovery process — things like lost wages for time spent fixing the problem, fees to reissue documents, notarized-letter costs, and, in some policies, legal fees for disputing fraudulent debts — generally subject to a per-incident or annual coverage cap. What it's not designed to reimburse, and generally doesn't, is money a thief actually stole. That distinction matters because federal law already caps your exposure to stolen money in the cases that come up most often: a lost or stolen credit card's unauthorized charges are capped at $50 under the Truth in Lending Act, and network "zero liability" policies typically go further still — see our explainer on credit card billing disputes for that cap and the parallel, tiered rule for a debit card under the Electronic Fund Transfer Act. An insurance rider is filling a real gap — the labor and incidental cost of recovery — not standing in for protections that already exist for the money itself.

Before buying a plan specifically for the insurance: ask directly what the per-incident and annual caps actually are, whether lost wages require documentation from an employer, and whether a claim can be denied because a loss is also covered by a homeowner's or renter's policy — a common exclusion. None of that shows up in marketing copy built around the word "insurance" alone.

What this doesn't mean

None of the above is a verdict that a paid plan is worthless — for someone who'd genuinely rather not manage freezes at three separate bureaus, track a weekly free report, or draft their own recovery letters after a breach, the convenience a paid plan bundles together is a real trade-off, not a scam. It's worth making that trade-off with an accurate picture of what's already free, what a subscription actually adds on top of it, and which categories of identity theft — medical, tax, benefits, synthetic — sit outside what any credit-based product, paid or free, is built to catch in the first place.

Related: see credit freezes, locks, and fraud alerts, explained and free credit report scams and imposter sites, explained for the free rights this page builds on, blocking fraudulent information from your credit report for what happens after an identity-theft entry actually lands on your file, and credit card billing disputes, explained for the federal liability caps that already limit what a card thief can actually cost you.