Identity theft in the U.S. was at an all-time high in 2016, with an estimated 15.4 million consumers hit with it in some form.1 This was up from 13.1 million victims in 2015, a 17.5% increase, and the highest number in any year. New account fraud, the type that affects auto dealers, was up 20%. Anecdotally, the number may be higher than that.
The insertion of chips into payment cards has caused card fraud to decline. So fraudsters and identity thieves are looking at bigger and more profitable ways to commit identity fraud. And automobile dealers are a prime target. Now would be a good time to update your Red Flags Program and train your people on identity theft. I have audited dealers who pass people with real red flags unresolved. You have to be diligent about identity verification in every deal.
The introduction of the Red Flags Rule in 2010 brought down the number of autos purchased by identity thieves but you can't get complacent and approve everyone who gets an identity score of 60 or above, or in some cases less, on an automated identity report. Identity reports are about reasons, not scores. The scores can be arbitrary and are not terribly scientific. They are intended as a shorthand to dig further and are not intended to be used as the only thing to consider when trying to establish the customer as being who they say they are. Look at the reasons given in the identity report that suggest this may not be the real person. Let's consider some tips that you may want to incorporate in your Red Flags program and in transacting with customers.
Social Security numbers
Social Security numbers are at the top of the list of red flags. Credit bureaus create credit files of up to 50 people or more using the same Social Security number. How do you think illegal immigrants get jobs and financial resources such as credit cards? Until June 25, 2011, the first three digits of a Social Security number (the "area number") reflected the address of the person when they applied for the Social. Each three digit number was linked to a state. You can find a useful chart at http://www.lavasurfer.com/info/socialsecurity.html.
But starting June 25, 2011, the Social Security Administration started issuing new numbers randomly because they were at risk of running out of numbers in largely-populated states while many numbers remained unissued in less populated states. Still, the list of 3 digit area numbers assigned to states prior to that time can be useful in asking a customer what state they lived in when their Social Security number was issued.
A credit bureau or information broker will generally have a good formula for determining whether the customer is likely to be the person to whom the Social was validly issued. Socials are never reissued although identity thieves try to use the numbers of dead people. If the identity report questions the legitimacy of the Social for your customer, you have a major red flag.
One way to clear this red flag is to ask the customer to pull up their Social Security earnings history statement on the Social Security Administration's website, https://secure.ssa.gov/RIL/SiView.do. This online access is available to all persons. Let them do it on their cell phone and when they pull it up, take a good look at it. Compare it against the information on the credit application as to date of birth, income, etc. Only the real person can pull up a Social Security earnings history statement using a password. If the customer declines to do so, that is another red flag.
Out-of-state Purchasers
In this day and age of Internet selling, identity thieves prefer transactions where they never have to meet the dealer in person. They will pick out a vehicle off your Website, offer to pay at or close to full price, take aftermarket products and financing, and ask you to ship the car to them. This should be another red flag. You want to do whatever you can to get the customer to come into the store so you can speak to them and verify their ID in person. If they won't, you really should have a "guilty until proven innocent" attitude about them being an identity thief.
Get the customer to send you a color copy of their drivers license. Then compare it to their state's license form by buying a copy of the I.D. Checking Guide, United States & Canada edition, available from Driver's License Guide Company, 1-800-227-8827. It contains detailed pictorials of each state and Canadian province's drivers license and U.S. federal documents like passports, visas, immigration documents, and military IDs. Compare carefully.
For out-of-state customers, use out-of-wallet knowledge based authentication questions which are available from your identity theft report provider. Make sure the customer answers all of the questions correctly and it is a best practice to get a second set to do the same. The customer may have the real consumer's credit report in their hands so questions about credit accounts may not be helpful. That's why two sets which will presumably contain some personal information questions are a better way to go. If the customer answers any questions wrong, get another set.
Engage the customer in a discussion in which you ask questions that you may not have the answers to but which will make the customer uncomfortable. Where did you go to high school?
What was the name of your first boyfriend/girlfriend? What is the street address you lived on in first grade? Identity thieves want quick easy transactions and if they think you are on to them, they may well just hang up the phone and abandon the transaction. Keep them talking and trust your gut.
Deals That Sound Too Good to be True Especially Late at Night
Identity thieves want in and out quickly. They often wait until close to the end of the month, close to the end of the day, and do little negotiation on vehicle pricing or financing. (Identity thieves don't pay with cash unless they are laundering money which is another subject). If the deal seems too good to be true, put your red flags radar up. If the customer pressures you to complete the deal quickly and deliver possession of the vehicle, again put your red flags radar up. Use some of the questioning techniques listed for out-of-state customers and slow it all down. The identity thief may just pick up and leave.
Fraud Alerts on Credit Files
If you pull a customer's credit file and it has a fraud alert, that is an indication from the real customer that they have been or may be the subject of identity theft. The Red Flags Rule requires you to do greater due diligence on a customer who puts a fraud alert on their credit file. You can ask the customer why they put a fraud alert on their credit file and let them know you will need to take extra steps to verify their identity as required by law.
Again, slow the transaction down, ask several rounds of knowledge-based authentication questions, and observe and listen carefully as the customer speaks and acts.
How Can You Tell If Someone is Lying?
There are going to be occasions when the story doesn't sound right, when you can only speak with an out-of-state customer over the phone, or you otherwise seem bogged down in red flags.
Keep talking to the customer, preferably in person. Here are some signs that a customer may be lying to you:
Follow your gut and intuition and don't approve the customer until you are satisfied.
Documents to Help Verify Identity
One of the advantages of the growth of the Internet is that many identity documents, that formerly came only in paper, can now be accessed online. In addition to a Social Security Earnings Statement discussed above, utility bills, bank statements, credit card statements, deeds, birth certificates (in some states), and other identity documents are available online. Ask the customer to pull up statements and identity documents. If the customer says "I never use the Internet," explain that by going to a credit card issuer's site, they can create a user name and password and pull up the account statements using their credit card number (which they may not have). Then you can review it and discuss the purchases on there.
Ultimate Goal Is to Make It Difficult and Uncomfortable for the Identity Thief
Identity thieves have gotten very sophisticated in being able to defend the identities they have stolen or created. Your goal in reviewing your red flags and other suspicions, is to make it difficult for the identity thief and slow down the process to better evaluate his or her legitimacy. As noted, identity thieves want quick, easy transactions. Having you assess them with questions they cannot answer or requesting documents they cannot provide will make the process slow and difficult and many will just walk out or hang up.
Talk at your 20-group meetings about other dealers' experience with attempted identity thieves and put your respective learning--including those described in this article--into your Red Flags plan and then implement it. The cost of identity theft--repurchasing a contract and not recovering a vehicle that has been chopped up or exported overseas--is just too great to do anything less.
1 Javelin Strategy and Research (2017)
_________________
Randy Henrick is an auto dealer compliance expert who offers compliance consulting services to dealers at www.AutoDealerCompliance.net. Randy served for 12 years as Dealertrack's lead regulatory and compliance attorney and wrote all of Dealertrack's Compliance Guides. He presented workshops at the last three NADA national conventions, speaks to dealer associations, and prepares training and other compliance materials for dealers. Because of the general nature of this article, it is not intended as legal or compliance advice to any person but raises issues you may want to discuss with your attorney or compliance professional.
The insertion of chips into payment cards has caused card fraud to decline. So fraudsters and identity thieves are looking at bigger and more profitable ways to commit identity fraud. And automobile dealers are a prime target. Now would be a good time to update your Red Flags Program and train your people on identity theft. I have audited dealers who pass people with real red flags unresolved. You have to be diligent about identity verification in every deal.
The introduction of the Red Flags Rule in 2010 brought down the number of autos purchased by identity thieves but you can't get complacent and approve everyone who gets an identity score of 60 or above, or in some cases less, on an automated identity report. Identity reports are about reasons, not scores. The scores can be arbitrary and are not terribly scientific. They are intended as a shorthand to dig further and are not intended to be used as the only thing to consider when trying to establish the customer as being who they say they are. Look at the reasons given in the identity report that suggest this may not be the real person. Let's consider some tips that you may want to incorporate in your Red Flags program and in transacting with customers.
Social Security numbers
Social Security numbers are at the top of the list of red flags. Credit bureaus create credit files of up to 50 people or more using the same Social Security number. How do you think illegal immigrants get jobs and financial resources such as credit cards? Until June 25, 2011, the first three digits of a Social Security number (the "area number") reflected the address of the person when they applied for the Social. Each three digit number was linked to a state. You can find a useful chart at http://www.lavasurfer.com/info/socialsecurity.html.
But starting June 25, 2011, the Social Security Administration started issuing new numbers randomly because they were at risk of running out of numbers in largely-populated states while many numbers remained unissued in less populated states. Still, the list of 3 digit area numbers assigned to states prior to that time can be useful in asking a customer what state they lived in when their Social Security number was issued.
A credit bureau or information broker will generally have a good formula for determining whether the customer is likely to be the person to whom the Social was validly issued. Socials are never reissued although identity thieves try to use the numbers of dead people. If the identity report questions the legitimacy of the Social for your customer, you have a major red flag.
One way to clear this red flag is to ask the customer to pull up their Social Security earnings history statement on the Social Security Administration's website, https://secure.ssa.gov/RIL/SiView.do. This online access is available to all persons. Let them do it on their cell phone and when they pull it up, take a good look at it. Compare it against the information on the credit application as to date of birth, income, etc. Only the real person can pull up a Social Security earnings history statement using a password. If the customer declines to do so, that is another red flag.
Out-of-state Purchasers
In this day and age of Internet selling, identity thieves prefer transactions where they never have to meet the dealer in person. They will pick out a vehicle off your Website, offer to pay at or close to full price, take aftermarket products and financing, and ask you to ship the car to them. This should be another red flag. You want to do whatever you can to get the customer to come into the store so you can speak to them and verify their ID in person. If they won't, you really should have a "guilty until proven innocent" attitude about them being an identity thief.
Get the customer to send you a color copy of their drivers license. Then compare it to their state's license form by buying a copy of the I.D. Checking Guide, United States & Canada edition, available from Driver's License Guide Company, 1-800-227-8827. It contains detailed pictorials of each state and Canadian province's drivers license and U.S. federal documents like passports, visas, immigration documents, and military IDs. Compare carefully.
For out-of-state customers, use out-of-wallet knowledge based authentication questions which are available from your identity theft report provider. Make sure the customer answers all of the questions correctly and it is a best practice to get a second set to do the same. The customer may have the real consumer's credit report in their hands so questions about credit accounts may not be helpful. That's why two sets which will presumably contain some personal information questions are a better way to go. If the customer answers any questions wrong, get another set.
Engage the customer in a discussion in which you ask questions that you may not have the answers to but which will make the customer uncomfortable. Where did you go to high school?
What was the name of your first boyfriend/girlfriend? What is the street address you lived on in first grade? Identity thieves want quick easy transactions and if they think you are on to them, they may well just hang up the phone and abandon the transaction. Keep them talking and trust your gut.
Deals That Sound Too Good to be True Especially Late at Night
Identity thieves want in and out quickly. They often wait until close to the end of the month, close to the end of the day, and do little negotiation on vehicle pricing or financing. (Identity thieves don't pay with cash unless they are laundering money which is another subject). If the deal seems too good to be true, put your red flags radar up. If the customer pressures you to complete the deal quickly and deliver possession of the vehicle, again put your red flags radar up. Use some of the questioning techniques listed for out-of-state customers and slow it all down. The identity thief may just pick up and leave.
Fraud Alerts on Credit Files
If you pull a customer's credit file and it has a fraud alert, that is an indication from the real customer that they have been or may be the subject of identity theft. The Red Flags Rule requires you to do greater due diligence on a customer who puts a fraud alert on their credit file. You can ask the customer why they put a fraud alert on their credit file and let them know you will need to take extra steps to verify their identity as required by law.
Again, slow the transaction down, ask several rounds of knowledge-based authentication questions, and observe and listen carefully as the customer speaks and acts.
How Can You Tell If Someone is Lying?
There are going to be occasions when the story doesn't sound right, when you can only speak with an out-of-state customer over the phone, or you otherwise seem bogged down in red flags.
Keep talking to the customer, preferably in person. Here are some signs that a customer may be lying to you:
- Pitch and tone – if someone speaks at a tempo that is out of character or unnatural, especially if it changes mid-sentence
- Long pauses between sentences or words. Stuttering
- Repeating a question
- Diversions or avoiding a question
- Answering a question with a question
- Claiming interference with the cell phone line
- Repeating themselves in a confusing way
- Defensive or sarcastic attitude
Follow your gut and intuition and don't approve the customer until you are satisfied.
Documents to Help Verify Identity
One of the advantages of the growth of the Internet is that many identity documents, that formerly came only in paper, can now be accessed online. In addition to a Social Security Earnings Statement discussed above, utility bills, bank statements, credit card statements, deeds, birth certificates (in some states), and other identity documents are available online. Ask the customer to pull up statements and identity documents. If the customer says "I never use the Internet," explain that by going to a credit card issuer's site, they can create a user name and password and pull up the account statements using their credit card number (which they may not have). Then you can review it and discuss the purchases on there.
Ultimate Goal Is to Make It Difficult and Uncomfortable for the Identity Thief
Identity thieves have gotten very sophisticated in being able to defend the identities they have stolen or created. Your goal in reviewing your red flags and other suspicions, is to make it difficult for the identity thief and slow down the process to better evaluate his or her legitimacy. As noted, identity thieves want quick, easy transactions. Having you assess them with questions they cannot answer or requesting documents they cannot provide will make the process slow and difficult and many will just walk out or hang up.
Talk at your 20-group meetings about other dealers' experience with attempted identity thieves and put your respective learning--including those described in this article--into your Red Flags plan and then implement it. The cost of identity theft--repurchasing a contract and not recovering a vehicle that has been chopped up or exported overseas--is just too great to do anything less.
1 Javelin Strategy and Research (2017)
_________________
Randy Henrick is an auto dealer compliance expert who offers compliance consulting services to dealers at www.AutoDealerCompliance.net. Randy served for 12 years as Dealertrack's lead regulatory and compliance attorney and wrote all of Dealertrack's Compliance Guides. He presented workshops at the last three NADA national conventions, speaks to dealer associations, and prepares training and other compliance materials for dealers. Because of the general nature of this article, it is not intended as legal or compliance advice to any person but raises issues you may want to discuss with your attorney or compliance professional.
RSS Feed