How to Prevent Identity Theft Scams at Your Dealership

Dealers often ask us how they should respond to people requesting information about why the dealership ran their credit. The nature of these requests is motivated by one of two things:

• Consumers demand to know why the dealership ran their credit, or
• Consumers are victims of identity theft.

The dealership may receive requests for information from a phone call, correspondence from the consumer, correspondence from an individual claiming to represent the consumer, or law enforcement. The response should be conditioned on whether the request is for identity theft information, or concerns previous credit inquiries by the dealership.

For most franchised dealers, our recommendation is usually simple and straightforward: Reply as the dealership, because it is the user of the credit report, not a furnisher of information under the Fair Credit Reporting Act (FCRA). To be clear, however, if the dealership finances transactions (buy here, pay here) or reports information to consumer reporting agencies on particular consumers, the dealership then is a furnisher under the FCRA, and has very different obligations to investigate and respond to claims from consumers. This article addresses the requirements the user of a consumer report must provide in response to consumer inquiries.

Previous credit inquiries

Frequently, consumers question a credit inquiry from the dealership that shows on their credit report and demand that it be removed, or that the information be sent to them verifying the dealership had a permissible purpose of requesting the consumer’s report. The dealership’s only obligation is to verify it had a permissible purpose for running credit on the individual. This can be accomplished by locating the signed credit application in either the deal file or dead-deal folder. Once you confirm consumers’ signed credit application, the only response required is to advise them that credit was run at their request and the dealership has a signed credit application on file.

Do not send, email, or fax a copy of the application to the individual making the inquiry. Once the dealership is satisfied that appropriate documentation exists for the credit request, nothing further is required. The only time consumers should be provided a copy of their signed credit application is when you are 100% certain they are who they say they are, or in response to an identity theft claim.

Identity theft

Under the FCRA, the user of a credit report must provide certain information to a victim of identity theft, law enforcement officials identified by the victim, or authorized individuals investigating the claimed identity theft on behalf of the victim. Before providing any information, however, the dealership must receive a written request for information, and verify both the identity of the individual claiming to be a victim of identity theft, and the theft itself. A request for information from an identity theft victim must:

• Be in writing, and
• If not initially provided, then at the dealership’s request, include available relevant information concerning the alleged identity theft, including the date of the transaction and any other identifying information.

Once an acceptable written request is received, the dealership must verify both the claim of identity theft and the identity of the person claiming his or her identity was stolen. To prove the claim of theft, the victim must provide a copy of a police report and a completed Identity Theft Affidavit. To check the identity of the person making the theft claim one of the following, at a minimum, must be provided:

• A government-issued identification card;
• Personally identifiable information of the same type provided the dealership by the unauthorized person; or
• Identifying information typically requested from customers financing their purchase.

After the victim has made the request and both the existence of a theft claim and the claimant’s identity have been verified, then — and only then — must the dealership turn over information concerning that transaction.

Don’t panic

The next time a consumer contacts your dealership demanding you take action concerning a credit report, don’t panic. Follow the guidelines stated in this article and respond accordingly. The consumer may not be satisfied with your response to the prior credit inquiry, but can take no action against the dealership that ran the credit report for a permissible purpose. If the consumer believes another person used his or her identification at your store, let that person take the necessary steps to report it as identity theft. Remember: The easiest identity theft scam in the world is to contact a creditor and demand to be sent a copy of the credit application.

For more information on this subject, contact the author or visit the Automotive Compliance Consultants website.

David R. Missimer, dmissimer@compliantnow.com, is general counsel for Automotive Compliance Consultants Inc. (www.compliantnow.com). He spent 28 years in private practice as a seasoned litigator and trial lawyer representing lenders, auto dealers and numerous other entities and individuals. He has worked with dealership compliance issues since 2003.