Let’s start with a hypothetical story of a typical day in the life of an F&I manager. He’s one delivery short of glory at month’s end when a sales associate TOs a hot one: full MSRP and all the options on a $60,000 black granite Suburban, no trade. Wants to finance the car through the dealership. The F&I manager takes the customer’s credit app and accidentally drools on it - he’s a doctor with apparently more money than negotiating skills.

When the bureau comes back, it is golden – angels bear it back to the F&I manager’s office from the fax machine to the strains of Handel’s Messiah. He has a small jet, a large yacht and an 850 FICO. Spot delivery on a five-pound deal is accomplished and the doctor drives away. High fives everywhere.

Fast-forward 45 days. The GM comes into the aforementioned F&I manager’s office and asks if he remembers Dr. Suburban. The F&I manager swallows hard and says “yes.” Turns out the delivery went to someone who stole the good doctor’s identity and evidently chose not to make the payments. Now the bank that bought the RISC is pushing back the paper on the dealership – something about not following the Red Flags Rule violating the lender agreement. Oh, and there's no insurance coverage for this loss.

We all know how this story ends. The dealership eats the $60,000 note, the thief sends the Suburban to Mexico and the F&I manager is taking down his certificates and brushing up his résumé. Had the dealership followed the Red Flags Rule, this unhappy event would never have happened - something a plaintiff's lawyer might mention in the complaint, should things really go south.

So, then, how could adherence to the Red Flags Rule have prevented this situation? The first red flag that should have caught the attention of dealership personnel was the absence of meaningful negotiation as to price. I mean, does anyone pay MSRP these days? This is not to say that all lay-downs are identity thieves, but it stands to reason that someone who won't be making the payments doesn't have much incentive to drive a hard bargain.

Electronic identity authentication programs are readily available and inexpensive. These programs run the offered identity against numerous databases to confirm that the identity is indeed real and doesn't belong to a person who is dead (and therefore unlikely to be needing a new car).

The real trick is to verify that the identity offered actually belongs to the person offering it. One way is to take care in the process of obtaining credit for the customer. Are there any gaps in the credit application? Does the applicant have poor memory about prior addresses or employment history? Those are red flags. Once identified, they need to be resolved.

One way to resolve a red flag is to ask the applicant to produce the credit cards listed on the credit report. It is unlikely that an identity thief would seek replacement cards in the victim's name - this would create a change of address record that could alert the victim to the identity theft event. Failure to produce the actual credit cards is itself another red flag requiring resolution before a vehicle can be delivered.

A more effective means of preventing delivery of a vehicle to an identity thief is to pose out-of-wallet challenge questions. "Out-of-wallet challenge questions" are those whose answers cannot be derived from a credit report. This generally means questions that go back more than seven years in the customer's personal history. "In what city did you live in 1987?" is an example of such a question. It is unlikely that an identity thief not related to the victim could answer this type of question.

Out-of-wallet challenge questions can be used as a means of resolving red flags that arise in the financing process, or uniformly in every finance or lease deal. For my money, the uniform approach is better. Using the same process for all non-cash customers is obviously more likely to catch a thief, and avoids the potential for discrimination claims. So you'll have that going for you, which is nice.

Out-of-wallet challenge questions are widely available and inexpensive, and can usually be obtained from the same vendors that provide identity authentication services as a combo platter.

Of course, whatever process the dealership employs to prevent the damage resulting from an identity theft event must be a part of its written Identity Theft Prevention Program, or ITTP. Another advantage of electronic, web-based authentication and verification programs is that they create a searchable, archived

record of the dealership's usage and, therefore, compliance with the terms of its ITPP.

Taking these steps can't prevent theft of an identity, but it can prevent a stolen identity from being fraudulently used at a dealership. The $60,000 Suburban stays on the lot and the chargeback never comes back to bite.