Statistics show that the Federal Trade Commission received more than 1.1 million complaints of identity theft in 2024, a 9.5% increase over 2023. 

The FTC is the governing body that oversees the Red Flags Rule. The rule states that a dealer has an obligation to have an identity theft-prevention program, or ITPP, in place to minimize the chances a thief can use a victim’s personal information to obtain a vehicle at the dealership. Once the dealership has an ITPP in place, it has a responsibility to ensure consistent application on every transaction.

There are software providers that dealers use to vet consumers. If there is a hit, the provider shows a failed status and provides direction to clear the discrepancy. The dealer needs to understand each red-flag alert on the report and address them appropriately.

What is a Red Flag?

Potential red flags fall into one of five categories: 

• Address discrepancy

• Social Security discrepancy

• Name discrepancy

• Credit freeze 

• Fraud alert

Address discrepancy seems to be the most common category. This occurs when the address provided by the consumer does not match the information at the credit bureau and/or in the supporting databases the software provider utilizes. 

I want to start off with a couple misconceptions regarding acceptable processes or proof-of-residence forms to clear a discrepancy. 

First, asking out-of-wallet questions is not a recommended approach to clear an address discrepancy. Second, the driver’s license or insurance card are not acceptable proofs. Identity thieves have become increasingly cunning and sophisticated. These forms are easily recreated and therefore should not be used to clear an address discrepancy.

Now the recommended ways to clear an address discrepancy: First, if you get a positive hit, review the input information for accuracy. Correct any typos or inaccuracies and rerun the search. If that corrects the discrepancy, move forward with the transaction. 

Second, confirm the address you are running matches the address on the contract. I see instances of a dealer entering the outdated address from a driver’s license, or “snowbirds” who spend time at two addresses, or repeat customers for whom the dealer extracts the address from the system. The dealer needs to ensure the red-flags search includes the accurate address.

The only way to handle a true discrepancy is to obtain documentation of proof of residence. Acceptable documentation includes a mortgage statement, rent/lease agreement, or a utility bill (phone, internet, water, electric, bank statement). The dealer is required to vet the documentation, retain a copy for the file, and note that you obtained proof of residence. Once these steps are taken, move forward with the transaction.

Bumps in the Road

I hear objections/obstacles dealers face when attempting to clear a red flag. Let’s address a few of those.

“We have a very affluent client base. They give us pushback when we ask for additional documentation.” My response to that objection? “Identity theft is one of the largest risks consumers like yourself are falling victim to. We are taking precautions to ensure your identity is safe and protected.” 

Another obstacle is the inconvenience factor — asking the consumer to bring back the documentation or a consumer saying they cannot provide the information because they do not receive physical statements in the mail. With modern technology, a consumer can pull up bank/mortgage statements and utility bills straight from a smartphone. The consumer takes a screenshot and sends it to you electronically. You make a copy for your file and clear the red flag.

The final objection involves post office boxes. The credit application requires a physical address. The consumer provides the physical address but uses a P.O. box as a mailing address. This will likely be an address-discrepancy hit. 

To clear the red flag, first ask for proof of residence matching the physical address. If the consumer is unable to provide documentation, I recommend pulling a tax record from the county website that shows the consumer resides at the physical address.

I cannot emphasize it enough: The correct approach to clearing the red flag is obtaining and vetting the information, retaining the information, and documenting that you did your due diligence.

Penelope Bell is an associate at Automotive Compliance Education (ACE) and gvo3 & Associates.