Enough to spend $110 a year on Lifelock, which says it scours the Web to watch for signs of identity theft, while promising to pay you up to $1 million to cope if you fall victim because its services failed?

How about $14.95 a month, or nearly $180 a year, on credit monitoring from FreeCreditReport.com - the folks with clever, catchy commercials featuring young losers who did fall victim, and as a result are still living at home or didn't get the girl?

I'm not going to tell you that these or any similar services are worthless. But if your primary concern is keeping prying hands out of your wallet and bank account, you should take a good, hard look at what's really going on.

Identity theft is a very real problem: serious, scary, potentially expensive, and nightmarish. But its risks are often seriously exaggerated, especially by the industry that has arisen to sell you protection.

The good news is that there are free and low-cost ways to monitor and reduce your risk. Better yet, some of those risks should be receding as regulators finally address a big flaw in our vaunted and much-criticized system of easy and instant credit.

Before I elaborate, consider how one of the scariest kinds of identity theft - new-account fraud - occurs: It happens when somebody who has obtained your personal information applies in your name for credit or services - say, to buy a new high-definition TV with instant credit at Best Buy.

Before last November, that person could have used your key identifiers, such as your name and Social Security number, and signed up for instant credit under a different address. The thief could have even had Best Buy deliver the TV to that different address.

The thief, of course, would then simply have ignored the bills, while enjoying the TV or trading it for cash. And you'd have been oblivious to the problem until you applied for credit yourself - and got turned down as a deadbeat. Yup, the goofy guys in those FreeCreditReport.com commercials weren't totally making that stuff up.

Now, thanks to rules adopted by federal banking agencies and the Federal Trade Commission, if the credit applicant provides an address different from the one listed in your main credit-bureau file, the credit issuer is required to take extra steps to verify that the thief is actually you - such as calling the phone number listed in that same credit-bureau file.

If this all seems painfully belated to you, there's a reason. Next month, the FTC will finally begin enforcing a set of new "red-flag rules," similar to the address-discrepancy rule, first envisioned by Congress in 2003, when it enacted the Fair and Accurate Credit Transactions Act.

The FTC has provided businesses with 26 examples of red flags for identity theft. They include such forehead-slappers as "fraud alert included with a consumer's credit report," an ID photo that's "inconsistent with appearance of customer," or "application appearing forged or altered." In each case, the business will be required to take steps to verify that the customer is who he says he is.

Why didn't that happen before? It undoubtedly did - at some businesses.

Paul Stephens, policy director at California's Privacy Rights Clearinghouse, says most of the red flags should have been obvious to anyone granting credit. The problem was willful blindness by some companies willing to risk high rates of fraud in return for high interest rates paid by honest consumers.

"It's what got us into the trouble we're in with mortgages and credit card debt," he says. "It was basically, 'Give out credit, give out credit, just do it - don't ask any questions.' They were so anxious to extend credit that they didn't bother to authenticate."

For several years now, consumers in most states have had an excellent, low-cost weapon against identity theft: placing a "security freeze" on their reports at the three main credit bureaus. For information on a freeze in your state, go to www.consumersunion.org/campaigns/learn_more/003484indiv.html.

With a security freeze in place, you won't find it quite as easy to access instant credit. You'll have to order a temporary "thaw" in your file. But it's a true bulwark against new-account fraud, typically the costliest variety of identity theft.

If you want to reassure yourself that you're not already a victim, the first thing to do is to check your credit report, which you can do for free at www.annualcreditreport.com or by calling 1-877-322-8228. (Do not contact the misleadingly named www.FreeCreditReport.com unless you want its expensive credit-monitoring service.)

Not all services that claim to be free come with costly strings in the fine print. One of the best tools I've run across lately is offered at www.MyIDScore.com, which gives consumers free access to a database that businesses use to guard against fraud. Basically, it alerts them to red flags for risky transactions before a sale goes through.

The site gives consumers an instant reading on whether they are at low, medium, or high risk. Fewer than 2 percent of consumers show up as high-risk - another sign that paying for identify-theft protection is probably throwing your money away.