Phone: 630-495-2282 Fax: 630-495-2260 Map/Directions

Countdown: Red Flags Rule mandatory compliance arrives Nov. 1

November 16, 2010

Compliance with the Federal Trade Commission’s new Red Flag Rule is mandatory beginning Nov. 1. But the "Rule" actually took effect Jan. 1, and dealerships that do not have an Identity Theft Prevention Program today can be found by the courts to exhibit "willful indifference" to the Rule, speakers said at a June seminar about the new regulation.

"You are liable right now, today," said Russ Radant of Automotive Compliance Consultants, an allied member company of the CATA that presented the seminar.

The Rule, which is mandated by the Fair and Accurate Credit Transactions Act of 2003, requires financial institutions or creditors—including dealerships—that engage in financing activities to establish an ID theft prevention program concerning all consumer accounts. Business accounts are covered by the Rule if there is a reasonably foreseeable risk to the business customer or to the dealership of ID theft.

Full details about the 256-page Rule are on the FTC’s Web site, All programs must have six distinct elements:

Policy A formal, written program that is signed by the officer of the corporation;
Training for employees—hands-on and continuous;
Detection and Prevention during transaction processing;
Mitigation measures to reduce fraud and minimize any impact on customers; and
Audit of the program at least annually.

A written program must include reasonable policies and procedures to identify and detect 26 Red Flags noted by the FTC, and respond appropriately when any Red Flags are detected.

Radant said one-third of all ID theft originates at dealerships. "Think about the number of people coming into your store every month," he said. "And not just on the sales side. What about repair orders?"

Radant outlined how camera phones can be used maliciously at service writer desks to record information about a customer and his vehicle from an RO. The thief then could call the customer, posing as an employee of the dealership.

"Mrs. Jones," Radant offered, "this is the dealership calling. I see that you were overcharged for service today on your Plymouth Valiant by $24.95. We can handle the overcharge three ways: I can credit your next service visit by that amount; I can arrange for a check for you—but that will take 30 to 40 days; or I can apply the credit to your charge card immediately, if you give me the account number." Choosing the third option yields to ID theft.

Examples of Red Flags that Radant said dealerships would encounter include:


• A consumer’s credit report has notice of a credit freeze
• The customer’s address on the credit report does not match his other paperwork
• Recent and significant increases in the volume of credit inquiries
• Accounts that have been closed for cause or identified for abuse of account privileges
• The Social Security number is listed on the death master file
• Discrepancy between customer’s date of birth and the correlating Social Security number range
• Locally, two or three Wisconsin addresses have been attributed to more than 500 immigrants applying for driver’s licenses.

For dealers who intend to treat the Rule internally, Radant said they must be prepared to create, implement, manage and audit a formal program. The NADA will publish a comprehensive guide on the Rule about Aug. 1. Or, many vendors provide the service.