Red Flags Rule

You probably know that the Federal Trade Commission (“FTC”) delayed the enforcement date for the Red Flags Rule, but that’s just one piece of the puzzle. Compliance with the Red Flags Rule may prove to be the best thing you can do for your dealership, especially if you are located in a high-identity-theft state such as Arizona, Nevada, California, Texas, Colorado, Florida or New York. The dealer and the dealer alone is the loser when an identity thief buys a car, and just one sale can really cost you.

A recent Georgia case (Cleveland Motor Cars, Inc. v. Bank of America, N.A.) involved a dealer who financed a $50,000+ BMW to an identity thief. The buyer made no payments and abandoned the vehicle, which was impounded by a storage company that sold the vehicle to recover its $305 impound fee. The lender got notice of the sale and demanded the dealer repurchase the contract, but it did not pay the impound fee or retake possession of the vehicle. It didn’t even tell the dealer about the sale.

When the lender sued for contract repurchase, the dealer defended himself by citing a Georgia law that requires someone suing for breach of contract to lessen damages by using ordinary care, such as paying the $305 or at least telling the dealer of the sale. But on appeal, the court ruled for the lender based on the terms of the dealer’s financing contract, which released the bank from any duty to mitigate. The court said that was OK. The contract language prevailed over the law.

So, if you total up the cost of contract repurchase, the vehicle’s value and the dealer’s attorneys’ fees, this one sale cost the dealer in excess of $150,000. Still think you don’t need a good Red Flags program? The FTC can seek $3,500 per violation, but your lenders may represent a bigger risk. You guarantee the identities of all your buyers, and your lender agreements probably have language on mitigating damages similar to this Georgia dealer’s agreement.

A good Red Flags program starts with a risk assessment of behavior that could indicate the possibility of identity theft at your dealership. These behaviors are your dealership’s “Red Flags.” The Red Flags Rule lists 26 examples to consider, but you don’t have to use those that don’t apply to you.

Then you must have procedures in place to detect any of your Red Flags in a financing transaction. Three ways to do this are to:

1. Check the customer’s identification documents

2. Examine their credit report for address discrepancies (a companion rule requires you to verify the customer’s address if you receive a “Notice of Address Discrepancy” on the credit report, which indicates the address you entered is materially different from any address for the customer in the credit file), fraud alerts, unusual recent activity such as spikes in credit usage, delinquencies or new credit cards

3. Run an electronic identity verification service on the customer’s information to check for fraudulent addresses, inconsistencies or problems with the Social Security Number (never-issued, someone else’s or a deceased person’s), and identify other suspicious facts. This third step is particularly important because you cannot obtain this information manually. Most identity verification services provide a free OFAC check and can give you “challenge” or “out-of-wallet” questions that cannot be learned from a credit report or stolen wallet and which only the real person should be able to answer correctly.

Red Flags programs that only check IDs and credit reports are very risky in states where identity theft is prevalent. Since every identity thief uses a bogus or stolen Social Security Number, this is a critical Red Flag and one you won’t detect using only ID documents or a credit report. Why? Because credit bureaus establish multiple files and put many people under the same Social Security Number, so an illegal immigrant or deadbeat dad can find it easy to establish a new “synthetic” identity using someone else’s legitimate Social Security Number. A recent study estimated that 88 percent of new identity theft is of the “synthetic” variety and you won’t catch that from just ID documents and credit reports.

The Red Flags Rule requires lenders to mitigate and prevent identity theft on accounts in their portfolios, so it is likely that lenders are going to look at their write-offs and attempt to determine which ones were synthetic identity thieves, such as a customer who pays well for a year and then just disappears. They are going to recourse these accounts back to dealers like any other identity theft account. As lenders get more sophisticated at doing this, dealers are going to get repurchase requests for accounts that may go back years.

So, the FTC may not be your biggest Red Flags risk. Look at your lender agreements and understand that if you sell a car to an identity thief, you stand a good chance of the lender detecting it some time in the future. As the dealer in Georgia found out, just one of these can be a very expensive proposition.