For years, identity protection has largely operated on a simple premise: alert consumers when their identity is being misused. If a new account is opened in a customer’s name, for example, identity protection services (IDPS) may notify them. But as cybercriminals move faster and deploy increasingly precise tactics, warning consumers after the fact is no longer enough.
This is driving a shift toward solutions that can provide scam predictability—platforms that analyze data and behavioral patterns in real time to determine whether consumers are at risk before a loss occurs.
As Tracy Goldberg, Director of Cybersecurity at Javelin Strategy & Research, discussed in the2026 Direct-to-Consumer Identity Protection Services Overview: Gains, Gaps, and Opportunities for Industry Growth report, strengthening scam predictability capabilities is crucial, but it is just one area of opportunity for IDPS providers.
Taking a Proactive Approach
Technology, and particularly artificial intelligence, is a central force behind the evolution of IDPS.
For example, AI has helped drive the rise of synthetic identity fraud, in which criminals construct fictitious identities from a combination of real and fabricated data points. This makes synthetic identities harder to detect, while also undermining the traditional identity protection model, especially because there may be no single identifiable victim. There’s no user to notify when a synthetic identity is used to perpetrate fraud.
AI has also made scams more difficult to discern—even for savvy users—while enabling criminals to deploy far more targeted schemes than were previously possible.
“For identity protection providers, scam predictability is important because fraud is shifting from account opening identity theft to authorized scams, where the consumer is manipulated into taking the action themselves,” Goldberg said.
“That includes bank impersonation scams, romance scams, investment scams, tech support scams, fake delivery texts, and business or family impersonation,” she said. “These scams often do not trigger classic identity theft alerts until it is too late.”
In a stronger system, an identity protection provider might warn a consumer before they click a malicious link, share a one-time passcode, or authorize a payment.
Yet despite the growing need for these capabilities, Goldberg found that scam predictability remained largely absent from the major IDPS products.
“The biggest thing that is going to differentiate IDPS providers in this consumer-facing space is going to be provisions around scam prevention and scam predictability,” Goldberg said. “What kind of signals are they bringing in to help them determine whether or not a particular consumer is susceptible or is likely to be targeted by a specific type of scam?”
“Then, how can they take that information to put protections in place that will help prevent that consumer from falling for the scam?” she said.
Protecting Vulnerable Gamers
One of the most effective ways to prevent scams is to shield consumers from cybercriminals’ attempts to initiate contact. For example, social media is frequently used to engage potential victims of all ages, but children are particularly vulnerable.
This has prompted recent efforts to strengthen protections for children on social media. Many leading platforms now offer dedicated youth or teen accounts that give parents greater visibility into their children’s digital interactions.
Unfortunately, similar protections are often lacking on online gaming platforms, which have become another channel for criminal activity.
“Most parents don’t have online gaming handles, they never get into Minecraft and look at who their children are playing with and what their profile is,” Goldberg said. “This potentially could become a dark place for a lot of children. Then, you tether to that the fact that children are so vulnerable and impressionable and with no oversight in this digital gaming platform, it can become a tool that cybercriminals use to target children.”
The challenge is compounded by the fact that many parents may not realize that children can communicate with other users on gaming platforms much as they do on social media. This creates a significant blind spot, and criminals are increasingly using gaming environments to establish relationships with and target children.
This vulnerability makes online gaming protections another area of opportunity for IDPS providers. Some have already begun offering gaming monitoring capabilities that mirror their social media monitoring solutions.
“If you provide the name of the handle that’s used on the online gaming platform or you provide login credentials, these platforms will monitor those accounts for any kind of suspicious activity,” Goldberg said. “If someone starts messaging that account or if there’s engagement with the child, it raises a flag, and they know sometimes if this is the handle of someone who’s been known to target other accounts.”
“There are some providers that are doing some of that, but we’d like to see more digital gaming monitoring deployed across the board,” she said. “Right now, it’s not common for all IDPS platforms to provide this.”
Easing the Security Freeze
Children are also vulnerable to attacks on their credit histories, even if they have not yet established a credit history themselves.
“The only way a child has credit is if someone has stolen the child’s identity and opened up a line of credit in the child’s name,” Goldberg said. “Putting a security freeze on the child’s identity helps to prevent a criminal from stealing the child’s social security number or date of birth and opening a credit account in that child’s name.”
Although freezing a child’s credit is an important protective measure, the process can be cumbersome because there is no centralized solution. Parents generally must freeze their child’s credit separately with each of the three major credit bureaus. The process can require written requests and documentation, such as the child’s birth certificate.
For many parents, that added friction can be enough to discourage them from freezing their child’s credit. Some IDPS platforms, however, are beginning to streamline the process. Equifax’s ID Watchdog, for example, offers services designed to make protecting a child’s identity easier.
“You can upload those documents to ID Watchdog and the platform will provide the hard copy to the different credit bureaus,” Goldberg said. “It’s about the IDPS platform providing more handholding, rather than just saying, ‘You need to file with the three credit bureaus.’”
“It’s walking the customer through the steps they need to take and maybe taking it a step further where you’re allowing consumers to upload those documents to the platform and then the platform has those copies mailed to the credit bureaus.”
Taking a Dual Approach
Overall, these developments highlight the need for IDPS firms to take a dual approach. And that’s by combining tailored guidance that helps users navigate emerging threats with strong technology-driven controls that can identify and mitigate risks before they result in losses.
“Education will be a piece of it, but a bigger piece of it is going to be the cybersecurity provisions,” Goldberg said. “It’s providing consumers with the ability to filter calls on their mobile device that they don’t know. If that person isn’t saved in their contacts list, does the platform provide the ability to filter calls? Does the platform provide the ability to install a VPN for the consumer’s home environment? Does the provider offer anti-malware?”
“These are the types of things that have to be offered, in addition to and above what we would have thought of as identity protection 10 years ago,” she said.
