Lifelock Settles With FTC

Last month I wrote that Lifelock had set aside $120 million to deal with its fight with the FTC (see post).  I assumed this would be a Wyndham-like fight that would go on for years.  Apparently I was wrong.

Last week Lifelock settled with the FTC and deposited $100 million with the court that is overseeing the case.  The reason this is being managed by a court is that the FTC took Lifelock to court for failing to live up to the terms of the 2010 settlement between the FTC and Lifelock.  In 2010, the FTC said that, among other things, Lifelock was misrepresenting what it could really do and was not managing the security of it’s customers’ information.

It is no secret that I am not a big fan of Lifelock.  I think they significantly overstate what they can actually do.  For the basic $120 a year membership, what they effectively do is look at your credit report and if they find something new, they call you or send you an email.  It is not clear that this is worth $120 a year.  Recently, I opened a new credit account and a competitor to Lifelock who was monitoring my credit at the time as a result of the Home Depot breach called me with an alert about this new account – 90 days after I opened it.  This is because it takes that long for this stuff to get reported to a credit bureau – if it even does get reported at all.

If you are willing to pay Lifelock $300 a year or more, they do additional things.  This requires that you give Lifelock access to your bank accounts, credit accounts, retirement accounts, etc.  Once you do that, they do the same thing for those accounts as they do for your credit report – compare them against their standards and if anything stands out, they generate an alert.

Recently, JP Morgan Chase posted an alert on their home page that said that if you give someone else access to your accounts (as you would have to do with Lifelock), Chase grants themselves permission to deny any claims that you make for losses.  What they would do in reality is not clear, but that certainly makes me nervous.

With the premium versions of Lifelock, you are trusting them with a lot of information.  If they don’t keep it safe, you have a real problem.

Going back to the FTC settlement, of the $100 million, $68 million is set aside to pay redress to class members who were damaged.  None of that $68 million can be used for lawyers’ fees or administrative expenses.  This is very different than normal class action cases where attorneys will take any where from a third to a half of the money.  In this case, the FTC gets at least $32 million (which is actually a third) to continue its efforts to protect consumers.  In general, that is probably better than giving that same one-third to lawyers.

By the way, this is the largest monetary settlement that the FTC has ever made.

So what did the FTC claim Lifelock did or did not do?

• That Lifelock failed to establish and maintain a comprehensive information security program to protect your information.
• That Lifelock claimed that they protected your information with the same high level safeguards that banks do.  Chase, for example, is spending $500 million a year to protect our information.  Is that how much Lifelock is spending?  I *think* what Lifelock meant by that statement is that they use SSL (Https://) on their web site.  That is quite different from what they said.
• That Lifelock falsely advertised that they would send an alert as soon it received any information that the consumer may be a victim of identity theft.  I gather that the FTC thinks that even that was delayed.
• Finally, the FTC claimed that Lifelock failed to follow the court’s record keeping order from the 2010 settlement.

$100 million is a lot of money and Lifelock, unlike Wyndham, did not fight it very much.  They must have thought that they did not have much of a case.  Even if they just fought it enough to reduce the penalty from $100 million to $50 million, that, it seems, would have been worthwhile.  It would seem that Lifelock didn’t think they could make enough of a case to pull even that off.

So, for those of you who are Lifelock customers, consider what you are paying and what you are getting.

Information for this post came from the FTC.

by