Red Flags Rule for Car Dealerships: Do You Need a Program?

The Red Flags Rule requires a dealership to have a written identity theft prevention program, but only if the dealer is a “creditor” with “covered accounts.” If you regularly pull credit reports, report to credit bureaus, or advance funds in connection with a credit transaction, you almost certainly need one. If you sell strictly for cash and do none of those things, the rule generally does not reach you. This guide explains how to tell which side you are on, what the program must contain, and how an independent lot can build one without a 60-page manual.

Loturn

Keep Vehicle Costs in View

Loturn tracks costs from purchase through recon, helping independent dealers see each vehicle’s true profit before the sale.

Visit Loturn

TL;DR

The Red Flags Rule (16 CFR Part 681) applies to dealers that qualify as creditors under the 2012 amendments, not to every dealer.
A compliant program is written, fits the size and complexity of your store, and covers four things: identify, detect, respond, update.
Management involvement, staff training and oversight of vendors that touch customer data are part of the rule, not extras.
The FTC enforces the rule against dealers, and a program that sits in a drawer does not count as a working program.
A small lot can use a short, practical program, as long as people actually follow it.

What the Red Flags Rule actually is
Are you a creditor? The test dealers get wrong
What counts as a covered account
The four elements every program needs
Management, training and vendors
How a small lot can keep it simple
Who enforces it, and what is at stake
The paperwork around the program
Our perspective
Keeping deal records in one place
A short checklist before your next financed deal
FAQ
Sources

What the Red Flags Rule actually is

The rule is the FTC’s identity theft regulation, written under the Fair and Accurate Credit Transactions Act. It lives in the Code of Federal Regulations as 16 CFR Part 681, and the FTC describes it as requiring many businesses to adopt a written identity theft prevention program that detects the warning signs of identity theft in day-to-day operations and takes steps to prevent the crime.

The regulation defines a red flag as a pattern, practice, or specific activity that indicates the possible existence of identity theft. In a dealership that might be a driver’s license photo that does not look like the person at your desk, or a Social Security number that does not match the credit report. It is a signal, not proof, and the program tells your staff what to do when one appears.

Two terms decide whether any of this applies to you: creditor and covered account.

Are you a creditor? The test dealers get wrong

Many dealers assume the rule covers every store, and others assume it covers none. Neither is right. Under the 2012 amendment, which narrowed who counts as a creditor, a dealer is covered only if it regularly, in the ordinary course of business, does at least one of three things:

Obtains or uses consumer reports in connection with a credit transaction.
Furnishes information to consumer reporting agencies.
Advances funds to or on behalf of a person, in connection with a credit transaction.

Think about how your lot really operates:

How you sell	Likely position
You collect credit applications, pull credit and arrange financing through lenders	Likely a creditor: you regularly use consumer reports
You run a buy-here-pay-here operation and report payment history to the bureaus	Likely a creditor: you furnish information, and you may advance funds
You offer in-house installment terms	Likely a creditor: review all three tests
You only sell for cash or buyer-arranged outside financing and never pull credit	Probably not a creditor under the three tests

That table is a reading aid, not legal advice. Facts matter: how often you do these things, and whether you do them as part of ordinary business. If your answer sits in a gray area, ask your dealer attorney or your state dealer association before you decide the rule does not apply. The FTC’s guide says plainly that if you do not meet the creditor definition you are not subject to the rule, so the question is worth answering on paper rather than by assumption.

What counts as a covered account

Being a creditor is half the test. The rule then asks whether you maintain covered accounts. Per the regulation, a covered account includes an account for personal, family, or household purposes that is designed to permit multiple payments or transactions, and an auto loan is the classic example. It also includes any other account where there is a reasonably foreseeable risk of identity theft to customers or to your business.

In practice that means a retail installment contract is covered automatically. A one-off cash transaction is different: it is covered only if you can reasonably foresee identity theft risk. Dealers often treat this as all-or-nothing for every deal jacket. It is not. You decide which account types carry risk, document why, and build the program around them.

The four elements every program needs

The FTC’s final rule lists four basic elements. The program must contain reasonable policies and procedures to identify relevant red flags, detect them, respond appropriately, and keep the program current. Here is what each looks like at the desk.

1. Identify the red flags for your business

Start from how identity thieves would actually hit a dealership. The regulation includes a supplement of example red flags in categories such as alerts from consumer reporting agencies, suspicious documents, suspicious personal identifying information, unusual account activity, and notices from victims or law enforcement. Pick the ones that match your deals. A typical list for a used car lot:

An ID that looks altered, forged or inconsistent with the applicant’s appearance.
A Social Security number, date of birth or address that does not match the credit report or application.
A fraud alert, credit freeze or address discrepancy notice on the credit report.
An applicant who cannot answer basic questions about information that should be on their own file.
A buyer who pushes to fund and drive immediately while avoiding verification.
A phone number or address on the application that matches known fraudulent applications.
Mail returned as undeliverable on an active contract.

You do not need to copy every example from the regulation. Choose the ones that fit and add your own as you see them.

2. Detect them during real transactions

Detection is a procedure, not a mood. Spell out the checks: who looks at the driver’s license, whether it is copied, how the name and address are compared to the credit report, and what happens when the credit bureau returns a fraud alert or an address discrepancy. Assign it to a role, such as the finance manager, so nobody assumes someone else did it.

3. Respond when you find one

Your program should say what happens next. Responses can include asking for additional identification, pausing the deal, contacting the customer at a known number, notifying the lender, not opening or funding the account, notifying law enforcement, or deciding no response is warranted after review. Write the escalation path in plain words: the salesperson stops, the manager decides, and the decision is noted in the deal file.

4. Update the program

The FTC calls identity theft an ever-changing threat, so this is not a set-it-and-forget-it exercise. Treat the document as living: add red flags from real incidents at your lot, from regulator guidance and from changes in how you do business, such as adding online credit applications. Review it on a schedule, for example every year and after any attempted fraud.

Management, training and vendors

The rule also requires continued administration of the program. At minimum that means involvement from the board or senior management, training for staff who handle these transactions, and oversight of service providers. For a small dealership, “senior management” is usually the owner. Have the owner approve the written program and sign and date it.

Training does not need a seminar. A 30-minute walk-through for salespeople and finance staff, repeated for new hires, with a short sign-in sheet, shows the program is real. Service providers are the part dealers forget: your credit application portal, your DMS, your accounting software and any outside F&I or collections vendor may touch customer data. Ask them how they protect it and keep their answers with the program.

When customers ask about no-credit-check financing options, the same discipline holds: a deal with thin credit checks is exactly where identity verification at the desk matters most, so the identification step cannot be skipped.

How a small lot can keep it simple

The rule is non-prescriptive. The FTC does not hand you a form; the program must be appropriate to the size and complexity of your dealership and the nature of your activities. A single-location independent can have a much shorter program than a franchise group. A workable small-lot program often fits in a few pages:

Scope: a short statement of why you are a creditor and which accounts are covered.
Red flag list: 10 to 15 items drawn from your own deals.
Detection checklist: the verification steps for every financed deal.
Response playbook: who decides, what you do, who you call.
Training and oversight: who is trained, when, and which vendors you reviewed.
Review log: the date of each annual review and what changed.

Over-engineering is a real risk. A 40-page manual that nobody follows is worse than a four-page program that every finance manager uses, because the first one documents your failure to follow your own rules.

Who enforces it, and what is at stake

The FTC enforces the rule against dealers. Under the Fair Credit Reporting Act’s administrative enforcement provision, a violation is treated as an unfair or deceptive act or practice under the FTC Act, and the FTC can use its investigative and enforcement powers, including bringing civil actions.

Identity verification failures also rarely travel alone. Lenders that buy dealer paper set their own rules for dealers, and regulators have looked closely at the dealer-lender relationship, as in a CFPB consent order involving an indirect auto lender, which describes how dealers submit applications on behalf of consumers. A sloppy file invites questions on more than one front.

The paperwork around the program

The Red Flags Rule does not sit alone. If you take cash, Form 8300 obligations also depend on correctly identifying the buyer. How long you keep identification copies, credit applications and your own program records is a separate question, covered in our guide to dealership document retention. And a clean, consistent deal file helps when something goes wrong, which is why a deal posting checklist belongs in the same routine as your identity checks.

Our perspective

We build financial software for independent used-vehicle dealers, and the pattern we see is the same in compliance as in accounting: costs and records get scattered, and nobody can see what is going on until something breaks. A deal jacket with the ID copy in one drawer, the credit app in an email thread and the lender stipulations in someone’s phone is the same kind of mess as a car with its recon costs on three receipts.

Our advice is practical. Decide honestly whether you are a creditor, write a short program that matches how your lot sells, name one person who owns it, and put every deal’s documents in one place tied to the vehicle. A program is only as good as your ability to show it was followed on a particular deal. We are not a law firm and Loturn does not write your Red Flags program for you, but organized, per-vehicle records make it far easier to prove that you did what you said you would.

— Eric Dosset

Keeping deal records in one place

Loturn is built for independent dealers who want every cost and document tied to the specific vehicle. Our AI document management, deal paperwork automation and mobile inventory app keep the records behind each deal organized, and every tool is included in one flat monthly price: Flipper at $99 per month, Dealer at $349 per month and Multi-Lot at $699 per month. We also handle free data import with onboarding support. See the Loturn plans and pricing to find the fit for your lot.

A short checklist before your next financed deal

Confirm you have a written, dated program signed by the owner.
Verify the government-issued ID against the applicant and the application.
Compare name, address and Social Security number to the credit report, and handle any fraud alert or address discrepancy as your program says.
Stop and escalate on any red flag, and note the outcome in the deal file.
Keep copies where only authorized staff can reach them.
Put the annual review on the calendar.

FAQ

Does the Red Flags Rule apply to every car dealer?

No. It applies to dealers that meet the creditor definition, meaning they regularly obtain or use consumer reports, furnish information to reporting agencies, or advance funds in connection with credit transactions. A dealer that does none of these is not subject to it. If you are unsure, get a written opinion from your attorney.

Who enforces the Red Flags Rule against dealers?

The Federal Trade Commission. Violations are treated as unfair or deceptive acts or practices under the FTC Act, and the agency has investigative and enforcement powers, including civil actions in federal court.

What is a red flag in a car dealership?

It is any pattern, practice or specific activity that suggests possible identity theft. Examples include a forged-looking ID, an address that conflicts with the credit report, or a fraud alert on the buyer’s file. A red flag is a prompt to verify and respond, not proof of fraud.

How long should our program be?

As long as it needs to be to cover your actual operations. The rule is non-prescriptive and scaled to your size and complexity, so a small independent lot can use a short program, provided it covers identification, detection, response and updates, and staff follow it.

How often should we update the program?

The FTC treats identity theft as an ever-changing threat, so review it at least yearly and whenever you see an attempted fraud or change how you sell, for example by adding online applications. Log each review with the date and the changes.