My father wouldn't put the phone down. I found him at his kitchen counter with twelve gift card receipts fanned out like a losing hand of cards, the silver scratch-off dust still stuck under his thumbnail. He kept glancing at the screen like the call might ring back any second. He'd driven to four different stores that morning - a Target, two CVS locations, one out past SouthPark Mall - buying gift cards in $400 increments because a voice on the phone convinced him it was the only way to keep the government from showing up at his door. Nearly five thousand dollars later, this is what identity theft actually looks like inside a family - not a headline, just a grown man standing in his own kitchen looking smaller than I'd ever seen him.
Before I go further, the honest disclosure: this site runs on affiliate links, and if you sign up for a monitoring service through one of mine, I earn a commission at no extra cost to you. I've spent four years paying for and stress-testing these plans across my own household and my parents' accounts, and I'm not a cybersecurity professional or a police officer - just an HR manager who lived through this and started writing down what actually worked instead of what the ads promised.
Two Scams, Four Years Apart
Two very different calls bookend this story, four years and one enormous leap in technology apart. The first was a stranger reading off a script, spoofing a Washington-area number and threatening a made-up gag order tied to a crime in Texas. The second happened this spring, and it used an AI-cloned version of my own voice - cadence and all - claiming I'd been in a wreck and needed money wired to a clinic fast. Set those two side by side and you get a real stress test for the whole identity theft industry, because the habit that stopped the second call - hanging up and calling back on a number already saved - had nothing to do with what stopped, or didn't stop, the first one. A low-tech script and an AI-cloned voice call for almost opposite defenses.
A Family Safety Rule the IRS Actually Wants You to Know
Here's the fact that would have ended this whole ordeal before it started: the IRS does not call and demand immediate payment by gift card, prepaid debit card, or wire transfer. If a taxpayer genuinely owes money, the first contact comes as a mailed bill, not a phone call with a countdown clock attached. Anyone on the phone demanding gift cards as tax payment is not the IRS. Full stop, no exceptions, no "special circumstances." I've said that sentence to my father more times than I can count, and I still catch myself wondering why it isn't printed on the side of every gift card rack in every drugstore in the country.
The warning signs were there before that final call, and we missed every one of them. He mentioned, almost in passing, that someone from "the Social Security office" had called a few days earlier asking him to verify his number - he'd hung up on that one, felt proud of himself, and never told anyone it happened. That first call wasn't the failure. Brushing it off as a closed chapter was. Scammers who get hung up on once often call back from a different number within the week, sharper and more specific the second time, and nobody in our family knew that was the pattern until it was too late to use it as a warning.
The Six-Hour Fraud Recovery Marathon
By the next morning, the shock had burned off and the paperwork phase began. We spent close to six hours filing reports, and if you're standing where we were, do not skip IdentityTheft.gov - the forms it generates are the only language banks and credit bureaus seem to actually respect. I've laid out the exact process in How to File a Police Report for Identity Theft Using FTC Forms, because the local police, polite as they were, couldn't do much without that federal report attached to the case number. A dated, signed FTC affidavit turns a phone call full of feelings into a document a bank's fraud department actually has to act on.
That binder of forms lives on a shelf in the spare bedroom that used to be a guest room and is now half office, half fraud-filing station. There's a sound I know well by now - the thunk of the rings snapping shut every time I slide one more dispute letter into a sleeve.
Would a Credit Freeze Have Stopped Any of It?
Short answer: partly, and only if we'd done it right the first time. A credit freeze wouldn't have stopped the gift card wire itself - that money left through a channel a freeze has no power over - but it would have blocked what came next. We signed up for LifeLock [Editor's Pick] that same week and worked through Steps to Freeze Your Credit at All Three Bureaus for Free, except we only actually finished two of the three that first week. The third bureau's site kept timing out, and we told ourselves we'd circle back. Two weeks later, someone tried to open a new credit account in his name through the bureau we'd left unfrozen. It got caught, but only because LifeLock flagged the application - the freeze itself had a hole in it exactly where we'd gotten lazy.
A fraud alert is a lighter, shorter-term step than any of that - worth knowing about, but not a substitute for a full freeze once a Social Security number may already be circulating. And once a number like his has been read aloud to a stranger on the phone, you have to assume it's exposed somewhere, whether or not anything ever comes of it.
Would Monitoring Have Caught It?
Monitoring is the part everyone assumes just works once you've paid for it, and that assumption bit us early. What a service like LifeLock is actually built to catch is different - a new account opening, an SSN showing up on an application it shouldn't, an address change nobody in the family made. The alerts weren't reaching anyone for longer than they should have, though. The notification settings had defaulted to email only, and it was an inbox he barely checked. My book club friend Marguerite Seals - who works in mortgage lending and has never trusted a product that calls itself foolproof - asked one afternoon whether anything had actually pinged my phone yet. Nothing had. We switched the settings to text and push that same day, and the setup finally matched what we'd paid for.
The Gas Pump Cloning That Monitoring Missed
My own scare came from a completely different direction, and no monitoring dashboard flagged it either. My card got cloned at a gas pump - a skimmer, most likely, tucked inside the reader in a way I never noticed at the time - and someone used the copied numbers to place a little over a thousand dollars in online furniture orders before I caught it. I found it scrolling my own statement, not through any alert, because the charges were structured to look like a handful of normal-sized purchases instead of one obvious spike. Spotting a compromised pump before you swipe is its own skill, and worth learning separately. The lesson that stuck with me is blunter: monitoring watches for your identity being reused somewhere else. It doesn't watch the physical moment your card gets skimmed in the first place.
Weighing LifeLock, Norton 360, and McAfee+ Side by Side
Four years of paying for these plans across two households taught me they're not interchangeable, even when the marketing makes them sound like it. McAfee+ Identity Protection was the one I tested for my own household because it was easier on the budget going in, and its Personal Data Cleanup feature - which requests your info be pulled off the "people search" sites scammers use to build their scripts - genuinely does the tedious work of asking site after site to take your address down. What it doesn't do as well is the reimbursement side, the actual insurance-style backstop if something goes wrong, and that's where the case for paying more starts to make sense. I broke down exactly how that math worked for my parents' situation in Is LifeLock for Seniors Worth the Monthly Cost for My Parents?, and the short version is that monitoring, insurance, and restoration are three separate promises, not one bundled guarantee. A plan can be strong on one and weak on the other two.
Norton 360 with LifeLock is the one I'd point to if you want fewer subscriptions cluttering your bank statement - antivirus, a VPN, and identity monitoring under one roof - but watch the renewal date like a hawk, because the price commonly jumps two to three times the first-year promo once that year is up. Dark web monitoring gets marketed hard across all three of these services, and what it actually surfaces - a leaked password here, an old account there - is a mixed bag. Useful information, but not the dramatic "we found your identity for sale" moment the ads imply.
None of these three touch a couple of other ways this can go sideways, either. A SIM swap that hijacks your phone number is a separate fight with your mobile carrier, not something identity monitoring detects in real time, and if your email account is the one credential that resets everything else you own, losing that fight matters more than any credit report ever will.
So Which Scam Do You Actually Prepare For?
So which of the two calls from the start of this should you actually build your defenses around? If it's the slow-moving, low-tech kind - a scripted caller, a fake agency, a demand for gift cards - your first moves are a credit freeze done properly across all three bureaus and an FTC report filed the same week, because that version of fraud gives you a little time to react. If it's the fast, high-pressure kind wearing a voice you recognize, no monitoring service reacts quickly enough; the only defense that actually works is hanging up and calling back on a number you already had saved before the panic started. Most families need both plans, not one or the other. For the ongoing account-monitoring side of it, I still point people toward LifeLock first, mainly because it's the one that's actually caught something in our case.
None of this makes me a financial advisor or an attorney, and I'd never pretend otherwise - I'm sharing what actually happened to my family and what we did about it afterward. If you're dealing with a loss anywhere near the size of ours, loop in your bank's fraud department and, if there's real money or a legal dispute involved, a consumer protection attorney too. What I can tell you, four years and two very different scams into this, is that the version of my father who exists now - checking his own account alerts, asking sharper questions before he trusts a caller - is in a completely different place than the man standing over those twelve receipts. That shift is worth more to our family than anything a subscription page can promise.