OPM Credit Monitoring: Who Qualifies, How to Enroll, and When It Ends

OPM credit monitoring is the free identity protection benefit the federal government provides to roughly 21.5 million people whose personal information was stolen in the 2015 Office of Personnel Management data breaches. The services are delivered by IDX under the MyIDCare brand and include three-bureau credit monitoring, up to $5 million in identity theft insurance, and full-service identity restoration. The current contract runs through September 30, 2026, and after that date participants will need to arrange their own protection.¹

Who Qualifies

Eligibility comes from two separate 2015 breaches. The first exposed the personnel records of about 4.2 million current and former federal employees. The second, much larger, exposed the background investigation files of approximately 21.5 million people, including federal employees, contractors, military members, and anyone else who had been through a government background check.

Section 632 of the Consolidated Appropriations Act of 2016 defines an “affected individual” as anyone whose Social Security number was compromised in either breach.² That reaches beyond federal workers themselves. Spouses, cohabitants, and references listed on someone else’s SF-86 security questionnaire can qualify if their Social Security number appeared in the file. Dependent minor children under age 18 as of July 1, 2015 were also covered under the initial contract, originally as a three-year benefit.³

Working for the federal government is not, by itself, enough. Only people whose Social Security numbers were part of the compromised records qualify for the government-funded coverage. If you were affected, OPM sent you a physical letter through the U.S. Postal Service; email was never used for notifications.⁴ If no letter ever arrived, you almost certainly were not on the list.

What the Coverage Includes

The program is administered by IDX, formerly known as ID Experts and branded to enrollees as MyIDCare. By statute, the coverage must be at least as comprehensive as what OPM initially offered and must carry at least $5 million in identity theft insurance.² OPM raised the insurance cap from $1 million to $5 million and applied the increase automatically to everyone enrolled.¹

The core services are:

Continuous credit monitoring at Equifax, Experian, and TransUnion, with alerts when new accounts or inquiries appear.
Up to $5 million in identity theft insurance to reimburse costs such as legal fees and lost wages while restoring a compromised identity.
Full-service identity restoration, meaning a specialist works directly with banks, creditors, and government agencies on your behalf if fraud occurs.
Cyber and dark web monitoring that scans for your Social Security number, health insurance identifiers, and other personal data appearing in unauthorized places online.

The IRS does not treat these services as taxable income. Under IRS Announcement 2016-02, the value of identity protection provided after a data breach is not reportable as gross income and does not go on a W-2 or 1099.⁵ Cash paid in lieu of services, or proceeds from an identity theft insurance claim, may still be subject to normal tax rules.

How To Enroll

Enrollment requires the 25-digit PIN from your original government notification letter. Without it, the system cannot verify eligibility, and IDX cannot issue a PIN over the phone.

If the letter is lost or the PIN no longer works, the OPM Verification Center can help. Call 866-408-4555, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, or use the OPM website. You will need to provide your name, address, Social Security number, and date of birth. The center will then mail a new letter confirming whether your records were compromised and, if so, providing a fresh PIN.⁶ Staff cannot confirm your status verbally for privacy reasons; everything goes through the mail.

Once you have a working PIN, visit the enrollment website listed in your correspondence, enter the 25-digit code, and create a secure account. The form asks for your legal name, Social Security number, email address, and mailing address. Accuracy matters, because IDX uses these details to link you to the right credit files. After you submit, IDX sends a confirmation email with a link to your monitoring dashboard.

When Coverage Ends

Section 632 requires OPM to provide identity protection for “not less than 10 years.”² The current IDX contract runs through September 30, 2026. Individual coverage for people who enrolled in 2015 or 2016 expires on the 10-year anniversary of their enrollment date. Those who enrolled later may have coverage that technically extends past the contract end date, but OPM has not announced funding for services beyond fiscal year 2026.

While the program is active, no renewal action is needed. Coverage continues automatically, managed by OPM and IDX.¹ “Automatic” stops meaning anything once the statutory period ends. IDX has already contacted participants with discounted offers for continuing service out of pocket. Some members of Congress have pushed for lifetime coverage; Representatives Norton and Ruppersberger introduced the RECOVER Act to require it, but the bill has not advanced.⁷

Reporting Fraud While You’re Still Covered

If you spot suspicious activity while enrolled, call the IDX cyber incident hotline at 1-855-435-7439. That line connects you with an identity restoration specialist who can begin working your case immediately, handling disputes with creditors, freezing compromised accounts, and coordinating with government agencies on your behalf. Full-service restoration is one of the most valuable parts of the program, so use it before coverage ends if anything unusual turns up in your credit reports or monitoring alerts.

Protecting Yourself After Coverage Ends

Stolen Social Security numbers, addresses, and SF-86 background details do not expire when the contract does. If you have relied on the OPM program for the past decade, the end of coverage is the time to build your own defenses.

The single most effective step is a credit freeze at all three major bureaus. A freeze blocks anyone from opening new credit accounts in your name, and placing or lifting one is free under federal law. You have to contact Equifax, Experian, and TransUnion separately. Each must place the freeze within one business day of an online or phone request.⁸ When you need new credit, you lift the freeze temporarily and reinstate it afterward, at no charge.

A freeze does not stop non-credit fraud. It will not prevent someone from filing a tax return in your name or using your health insurance. For those risks, consider:

Requesting a six-digit IRS Identity Protection PIN each year, which blocks anyone else from filing a federal tax return using your Social Security number.
Placing a fraud alert. A free initial alert lasts one year and requires creditors to verify your identity before opening accounts. An extended alert lasts seven years but requires a filed identity theft report.
Comparing paid monitoring plans. IDX and other companies sell services similar to what you had. Many credit card issuers and banks also offer basic monitoring at no charge.
Pulling your free annual credit reports from each bureau at AnnualCreditReport.com. Regular review catches unauthorized accounts even without a paid service.

One older avenue is closed. A separate $63 million class action settlement against OPM was finalized in October 2022, with a claim deadline of December 23, 2022. No further claims can be filed.

1
U.S. Department of the Interior. OPM Credit Monitoring and Identity Protection Services and General Cyber Updates
2
U.S. Government Publishing Office. Consolidated Appropriations Act, 2016
3
Department of the Navy. OPM, DoD Announce Identity Theft Protection and Credit Monitoring Contract
4
U.S. Department of the Interior. Message from OPM on Cyber Incident
5
Internal Revenue Service. Federal Tax Treatment of Identity Protection Services
6
U.S. Department of the Interior. OPM Update on Response to Cyber Intrusion
7
Office of Representative Eleanor Holmes Norton. Norton, Ruppersberger Introduce Bill to Provide Lifetime Identity Protection
8
Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report