Identity theft protection is a service that watches for signs that someone is using a person's identity, and alerts the person early. Identity theft means a criminal using another person's details, such as their name, PAN, Aadhaar number or phone number, to borrow money, open accounts or pass identity checks in that person's name. The service is often sold as part of antivirus and security suites.
The service watches two kinds of place. First, it searches leaked data. When a website is hacked, its customer records are often sold on criminal forums. The service checks those leaks for the person's email, phone number and ID numbers, in the same way that dark-web monitoring does for a company. Second, it watches new credit. A credit bureau records every loan and credit card in each person's name. A loan that the person never applied for is the clearest sign that their identity has been used.
Consider a software engineer in Noida. The service sends her an alert on a Monday: her PAN and date of birth have appeared in a leak from a shopping website. Two days later, a second alert arrives. Her credit report shows a new personal loan of ₹40,000 from a lending app, which she never took. Because she learns about it within a week, she can act quickly. She reports the fraud on the national cybercrime portal. She writes to the lender and to the bureau to dispute the loan. If she had found the loan only months later, when she applied for a home loan, the unpaid EMIs would already have lowered her credit score.
The first alert has a second use. If a leak includes a password, the person should change it at once, on every site where they used it. A password manager makes this easy, because each site already has its own password.
The service can warn, but it cannot stop a lender from giving the loan. Checking the borrower is the lender's job, through KYC. In the United States, where this product began, such services also include insurance and staff who help undo the damage. In India, security suites mainly offer alerts about leaks. Alerts about the credit report come mainly from the credit bureaus: under RBI rules, a bureau must send the person an SMS or email whenever a lender looks up their credit report. Anyone can also check their own credit report free once a year from each bureau, under RBI rules, or use a credit score monitoring app.