Federal officials don't seem to be going out of their way to routinely monitor whether dealerships are complying with the Red Flags Rule, which went into effect last year, but that doesn't mean dealers can relax about identity theft.
"I haven't seen any enforcement action being taken as a pre-emptive measure," Gil Van Over, a compliance expert and dealership consultant, told Automotive News. He is president of gvo3 & Associates in Crown Point, Ind.
"Why go after somebody who may be in great shape? Why spend all that time and energy looking at a dealership that's doing it right?" he said.
Nonetheless, Van Over said dealers face dire consequences if identity theft is detected and it turns out after the fact that the dealership failed to comply with the Red Flags Rule.
Preventing ID theft
The rule is aimed at preventing identity theft. Dealers must create and maintain a written plan for complying. The plan spells out how the dealership will detect "red flags" and who's responsible for doing what.
Examples of red flags could include cases in which the customer's photo identification doesn't look like the customer, the address provided doesn't match the customer's official records, or the customer is in an unusual hurry and doesn't appear in person to take delivery.
The rule originally was to take effect in 2008, but the Federal Trade Commission delayed enforcing it several times until last year. Potential penalties are high -- $2,500 per incident, according to the National Automobile Dealers Association. For repeat offenses, penalties are up to $11,000 each, the dealer group said.
Still a 'focus'
Carole Reynolds, senior attorney for the FTC's Division of Financial Practices, said that the Red Flags Rule is still on the FTC's radar.
"It is something that can be and remains a focus, so I think that that's something that should be -- you should continue to be reviewing in terms of the dealership," she said.
She made her remarks June 20 during an Automotive News F&I Week Webinar.
Michael Benoit, a partner with the Hudson Cook law firm in Hanover, Md., said during the Webinar that in addition to the FTC, several states have their own identity-theft laws.
"I haven't seen, for example, state regulators coming to dealerships looking to see their Red Flags policy and that sort of thing," he said. "But what I have seen are attorney generals launching investigations against creditors where there has been an identity theft, and where it appears that lax procedures or ineffective compliance played a part in letting that happen."
Send us a letter
Have an opinion about this story? Click here to submit a Letter to the Editor, and we may publish it in print.
