How identity theft “protection” is a scam