Identity theft insurance: Is it worth it?

A CBC investigation about an Ontario woman who was defrauded on three different occasions for thousands of dollars at her bank seems like a perfect illustration of why people should invest in identity theft insurance.

• GO PUBLIC: RBC customer's bank accounts looted 3 times by identity thieves

But there is disagreement among industry experts about whether insurance like this is necessary.

Identity theft insurance is "generally not a good deal," says John Lawford, executive director and general counsel for the Public Interest Advocacy Centre in Ottawa.

He says that Canadian banks will generally cover losses anyway, meaning that a $20-a-month insurance premium may be superfluous.

On the other hand, Walid Hejazi, a professor at the Rotman School of Management who specializes in information security for businesses, says additional coverage is nonetheless worthwhile.

As he sees it, it can help defray other expenses associated with fixing your financial affairs once you've been compromised, expenses such as administrative fees, postage, hiring a lawyer and time off work.

"I would argue that those insurance policies are fantastic, because all of those other costs can be quite significant," says Hejazi.

Switched banks

Identity theft occurs when an individual captures another's person's vital information such as a social insurance number, a driver's license or a banking password and then impersonates that individual, either virtually or physically, in order to steal funds.

This is what happened to MeghannJohnston, who was a three-time victim of identity fraud. Each time, an imposter walked into anRBCbranch pretending to be her, presentedfake ID and wasallowedto withdraw money from her account.

The bank reimbursed Johnston on all three occasions, and each time reassured her that it was implementing safeguards to ensure it wouldn't happen again. After three breaches, Johnston says she has switched banks.

According to statistics gathered by the Canadian Anti-Fraud Centre, which is a branch of the RCMP, identity theft has been on the rise.

In 2008, the CAFC reported there were 12,309 victims of identity fraud in Canada, with a total reported loss of about $9.7 billion.

In 2012, there were 17,009 incidents and nearly $16 billion in losses. Halfway through 2014 the last period for which there are statistics the CAFC had documented over 10,000 victims and $4.7 billion in losses.

Due to how insurance companies report, it's not easy to track how many Canadians currently have fraud insurance. But it appears to be increasingly common.

"It's popular in the sense that it's being offered more and more, and likely there are more and more claims occurring because of that," says Pete Karageorgos, director of consumer and industry relations for the Insurance Bureau of Canada.

Phishing expeditions

Karageorgos says there are a number of ways a person could become vulnerable to fraud.

You might leave a document with your address or social insurance number in a public place. You might unwittingly divulge some sensitive data through one of your social media accounts.

Or you might fall prey to an email phishing scam and reveal your bank password.

• How phishing works

"Today, with online banking and all sorts of online transactions and e-commerce, there are a lot more access points available for someone to become you and steal your identity," says Karageorgos.

Unlike financial institutions in countries such as Great Britain, Canadian banks are generally willing to reimburse people who have been defrauded, regardless of whether they have insurance, says Hejazi at the Rotman School.

"In Canada, if there's identity theft or somebody uses your credit card or accesses your bank account, as long as you can prove it to the bank, the banks are pretty good at reimbursing you," he says.

However, in his view, the inconvenience and administrative costs of resolving fraud make added coverage a sensible option.

Insurance 'not the problem'

While many insurance firms provide fraud coverage as a standalone product for a monthly premium, some companies also offer it as a rider on larger asset coverage, such as home or auto insurance.

PIAC's Lawford says this option is generally cheaper and basically gives you the same coverage.

"That's probably the most cost-effective option, if you feel you want this stuff," says Lawford.

Ultimately, he believes insurance "is not the answer to the problem."

He thinks a better solution to identity theft is "mandatory breach notification" that is, legislation that would force financial institutions to immediately tell a customer when they've been compromised.

A bill that would compel companies to report data breaches in a timely fashion to clients as well as the federal privacy commissioner was introduced in Parliament in 2010, but it has yet to be passed.