The Red Flags Rule, which went into effect in 2008, requires businesses such as dealerships to identify likely indicators of identity theft and put reasonable detection and response procedures in place. In certain circumstances, dealerships can be fined up to $2,500 for each violation of the Red Flags Rule.
While it has increased dealership compliance and training costs, it also is helping prevent incidents, in part, by increasing awareness, Covington said.
Dave Robertson, executive director of the Association of Finance and Insurance Professionals, agrees that crackdowns like the Red Flags Rule have been beneficial.
"It's still a major problem, but it's not growing as fast," Robertson said.
While no hard numbers are available on identity theft cases specifically involving dealerships, the Federal Trade Commission does report data on consumer complaints to law enforcement and consumer advocacy organizations. Identity theft is the top consumer complaint, according to the FTC, though the number of complaints dropped through 2010 after peaking at 314,521 in 2008. Complaints had fallen to 250,854 by last year.
McKessy, the prosecutor in the Arizona case, says she has seen fewer instances of identity theft related to dealerships in the past five years.
McKessy and dealership advisers say instances can be cut down further with some simple practices.
It can be as low tech as closely examining a customer driver's license and then scrutinizing the person in front of you, they said. If the license says he is 40, ask more questions if he doesn't look 40, Robertson said.
Use the information a Social Security number reveals as another test, Robertson said. The first three numbers correspond to the geographic area. So a finance manager could say: "So you got your card in Illinois," when it really came from Iowa, to see whether the customer knows to correct that information. AFIP has laminated cards available that list Social Security number prefixes and their place of origin.
A dealer who is hiring should ask for references, particularly prior employers, and then call and check those references, Covington said.
Make sure middle managers also are informed on identity theft and prevention tactics, she said.
"The biggest thing a dealer can do is build the culture of awareness about identity theft," Covington said, "so everyone is thinking about it and thinking about preventing it."
While there is increased cost involved in complying with the Red Flags Rule and putting preventive measures in place, the benefits far outweigh the expense, Covington said. A security breach could cost the dealership a lot more in the long run.
Dominick Hurley's criminal history also underscores the need for an employee background check.
That didn't happen when Hurley was hired at Henry Brown, which has since tightened its policies. According to McKessy and Much, the Brown dealership management didn't know the extent of Hurley's felony convictions when they hired him -- but they were aware he had been to prison.
"But this guy is the most magnanimous person you would meet," McKessy said of Hurley. "He's a spin master. That's why he's so good at his job."