

The reason lenders don't routinely verify your identity before issuing you credit is that it takes time, costs money and is one more hurdle between you and another credit card. This service pisses off the credit bureaus and their financial customers. Several companies have sprung up - LifeLock, Debix, LoudSiren, TrustedID - that automatically renew these alerts and effectively make them permanent. This alert is temporary, and expires after 90 days. In December 2003, as part of the Fair and Accurate Credit Transactions Act, or Facta (.pdf), credit bureaus were forced to allow you to put a fraud alert on their credit reports, requiring lenders to verify your identity before issuing a credit card in your name. But the company's story has some interesting security lessons, and it's worth understanding in some detail. With its aggressive advertising campaign and a CEO who publishes his Social Security number and dares people to steal his identity - Todd Davis, 457-55-5462 - LifeLock is a company that's easy to hate.

There are also a lot of errors and misconceptions. They're being sued by credit bureaus, competitors and lawyers in several states that are launching class action lawsuits.

LifeLock, one of the companies that offers identity-theft protection in the United States, has been taking quite a beating recently.
