LifeLock is a real identity-theft-protection service — and a two-time FTC record: $12 million in 2010 over deceptive protection claims, $100 million in 2015 over allegations it violated that order, and more than a million FTC refund checks mailed in 2019.

Scam verdict · Educational pattern check

Scam Detective research desk · Updated October 2026

Real service — $100M FTC record

Is LifeLock Legit? The Service Is Real — So Is Its $100 Million FTC Record

Q: Can identity-theft protection prevent identity theft?

No. What the service does is monitoring, restoration help, and insurance; what no service does is prevent identity theft. Marketing “protection” is not prevention — no service can stop your data from being misused, only spot it after. The strongest defenses are free: credit freezes, fraud alerts, and IdentityTheft.gov.

LifeLock is a real identity-theft-protection service — and a two-time FTC record. In 2010 it paid $12 million over deceptive protection claims; in 2015 it paid $100 million — the FTC's largest order-enforcement award — over allegations it violated that order while advertising bank-level safeguards and instant alerts; in 2019 the FTC mailed more than a million refund checks. What the service does is monitoring, restoration help, and insurance; what no service does is prevent identity theft. Weigh the subscription against the free defenses: credit freezes, fraud alerts, and IdentityTheft.gov.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

Straight from the source

The verdict stands on the public record — the line below is quoted verbatim from the source named under it.

“The fact that consumers paid Lifelock for help in protecting their sensitive personal information makes the charges in this case particularly troubling.”

— FTC Chairwoman Edith Ramirez, Dec. 17, 2015.

Why this question never goes away

The honest verdict has two halves. The service is real: it monitors for misuse of your identity and offers restoration help and insurance. The record is real too: the FTC's 2015 contempt filing alleged that from 2012 to 2014 LifeLock failed to maintain the comprehensive security program its own 2010 order required, advertised financial-institution-level safeguards it didn't have, and promised alerts “as soon as” it received any indication of identity theft — claims the FTC said were false. The settlement: $100 million, with $68 million routed to class-action consumers; the remainder funded the FTC's 2019 refunds — more than one million checks averaging about $29, for 2012–2014 members the class action hadn't paid. Two lessons survive. Marketing “protection” is not prevention — no service can stop your data from being misused, only spot it after. And the strongest defenses are free: credit freezes at all three bureaus, fraud alerts, and the FTC's own recovery plan at IdentityTheft.gov.

Five red flags — any one is enough

Any service promising to “prevent” identity theft — the FTC's cases exist precisely because protection claims outran reality; monitoring is detection, not immunity.

Fear-first advertising — breach urgency is a sales channel; the free defenses (freeze, alert) come first.

“Bank-level safeguards” language without specifics — the FTC alleged LifeLock's own version of that claim was false.

Instant-alert promises — the “as soon as” claim was one of the FTC's counts; real monitoring has latency and gaps.

Any “identity protection” caller, text, or email you didn't solicit — the category's fear pitch is a standing phishing costume, including fake renewal invoices.

Your next three moves

Do the free defenses first — credit freezes at Equifax, Experian, and TransUnion, plus fraud alerts — before paying anyone; navigate to the bureaus yourself.

Don't buy “protection” from a cold call, text, email, or pop-up, ever.

Report deceptive protection claims at reportfraud.ftc.gov; actual identity theft goes to IdentityTheft.gov — and check any “renewal” or “alert” link with the $2 instant check.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.