You’ve had your eye on the car of your dreams. You know the one I’m talking about. It’s so far out of your budget it’s funny. Now imagine stealing it from a dealer’s lot. How would you go about doing it? 

• Break the window or jimmy the lock, hot-wire the vehicle, and peel out.

• Act like this is a car heist movie. You and a friend enter a dealership, ask a dealer to hear that motor purr, and while the dealer is showing your friend the motor and answering questions, you snag a clay imprint of the key for a late night heist, hack the car’s on-board diagnostics port, or spoof the owner’s key fob signal.

• Or, more simply, you walk into a dealership, pretend to be someone else, sign the forms, and drive away in your new BMW. Identity theft for the win.

Even though you’d never steal a car, there are an increasing number of car thieves opting to use that third, identity theft, approach. And rather than going after cars on the street, they’re targeting dealers.

They’re walking straight into F&I offices, presenting bogus ID and loan documents, and defrauding dealers out of cars before any employee has a chance to catch on. You and your F&I team are the first line of defense in a real-life Nicolas Cage car heist movie.

What Does Your Identity Theft Program Look Like?

We’re all in the same boat when it comes to the Federal Trade Commission's Red Flag Rule, but how we get to compliance might look different. As a creditor, you know your dealership must have an identity theft program in place. Ask yourself:

• Are you using software to track activity patterns or practices?

• How are you and your team detecting and identifying a red flag? Does everyone get regular training on what to look for?

• How often do you review your program?

• Are you on the lookout for money laundering schemes?

Jason Keegan, vice president and general manager of fraud and protection at FICO, recently talked about how the new influx of identity fraud–fueled car theft puts businesses in a difficult position. Hiring on-site security experts or training salespeople to spot fake IDs isn’t always tenable. Subjecting customers to rigorous identification processes, meanwhile, could cause them to walk away. It’s an ideal environment for thieves.

So What Do You Do?

Well, you certainly don’t want to be in the position of having to buy back a contract from a lender in the case of identity theft. And you don’t have to overhaul your workforce or make your customers undergo extensive ID checks. It’s about consistent practices, reviews, and training to be on the lookout for:

• Suspicious documents that might be forged, like down payment checks with wrong names or addresses, or mismatched addresses on credit applications, licenses, or credit reports.

• Suspicious personal information like different colored eyes or inconsistent addresses from the documentation that is provided.

• Suspicious activity like recently established credit accounts or a significant increase in inquiries.

• Behavioral red flags from the individual like agreeing to a dealer’s price without negotiation, buying all finance products quickly and without question, no need for a walk around, or car prepping or washing.

• Any warnings from credit reporting agencies or fraud detection services.

Your identify theft program should include a process for how to handle the prevention and the resolution of these red flag areas. If you’ve found a red flag, that doesn’t necessarily mean that your customer is attempting to pull a fast one on you, but be diligent:

• Ask for additional identification, like a utility bill or mortgage statement.

• Ask the customer questions that they couldn’t guess from having a stolen wallet: Which company do you send your car payments to? What’s your mortgage payment?

Remind your customers that your dealership takes personal information and identity theft very seriously, so your need for additional information is for their protection and to help secure identity. 

If the customer can’t provide you with proper documentation, or if any red flags come up, stop the transaction immediately and follow your identity theft program procedures. When in doubt, escalate the issue to your supervisor or Red Flags Program Manager to determine how to respond. Remember that identify theft and fraud will continue to evolve, so be on alert and review your program processes frequently. If you need support or guidance on your organization’s Red Flags Program, reach out to a third-party consultant company.

Aaron Hartshorn is one of KPA's district managers of F&I compliance. He provides sales and finance consulting with industry and regulatory knowledge through onsite field audits, employee training, and regulatory research. He can be reached at Info@kpa.io.