Why California Dealers Need an FTC Red Flags Rule Identity Theft Prevention Program

The FTC Red Flags Rule identity theft prevention program is a federal requirement for most auto dealers that offer or arrange credit or lease vehicles. In California, Red Flags Rule compliance ties directly into your overall sales and F&I compliance program, including your GLBA Safeguards and state privacy obligations.

The Rule requires your dealership to create, implement, and maintain a written Identity Theft Prevention Program (ITPP). That program must help you:

• Identify red flags of identity theft in covered accounts
• Detect those red flags during your normal sales and F&I processes
• Respond appropriately to prevent and mitigate identity theft
• Update the program periodically based on experience and new risks

The Red Flags Rule is issued under the Fair Credit Reporting Act and implemented by the Federal Trade Commission and other federal agencies. You can review official guidance at the FTC’s Red Flags Rule page: FTC Red Flags Rules.

Step 1: Determine Whether Your Dealership Is Covered

Most franchised and independent California dealers that extend or arrange credit are covered “creditors” under the Red Flags Rule. You are generally covered if, in the ordinary course of business, you:

• Regularly arrange financing or leasing through third-party finance sources, or
• Offer buy-here-pay-here (BHPH) or in-house financing, or
• Allow customers to pay over time under a retail installment contract

Covered entities with “covered accounts” must have a written identity theft prevention program. The FTC explains who is covered and what a covered account is on its Red Flags Rule resource page. See: FTC Red Flags Rule Coverage.

Step 2: Conduct a Risk Assessment for Your Dealership

An effective FTC Red Flags Rule identity theft prevention program starts with a dealership-specific risk assessment. The goal is to identify where identity theft risks arise in your operations.

Consider at least these areas:

• Sales and F&I workflow – internet leads, credit applications, test drives, spot deliveries, out-of-state buyers
• Payment methods – credit cards, ACH, wires, down payments, trade-in payoffs
• Account maintenance – address changes, phone/email updates, payment method changes
• Collections – BHPH or in-house accounts, repossessions, skip tracing
• Systems and vendors – DMS, CRM, credit report providers, e-contracting platforms

For each process, ask:

• What personal and financial data do we collect?
• Who has access to it?
• How could a fraudster exploit this step to commit identity theft?
• What controls already exist (e.g., ID checks, fraud tools)?

Document your risk assessment and keep it with your compliance files. This becomes the foundation of your written program.

Step 3: Build Your Written Identity Theft Prevention Program

The FTC requires a written program that is appropriate to the size and complexity of your dealership and the nature of your activities. A typical auto dealer Red Flags Rule written program includes:

• Policy statement and purpose
• Definitions (covered accounts, identity theft, red flags)
• Roles and responsibilities (program administrator, F&I, sales, collections)
• Risk assessment summary
• Procedures for identifying, detecting, and responding to red flags
• Staff training requirements
• Oversight of service providers
• Recordkeeping and reporting
• Annual review and approval process

Make sure the language in your program matches your actual dealership processes. Generic policies that do not reflect day-to-day operations are a common audit weakness.

Step 4: Identify Relevant Red Flags for Auto Dealers

The Red Flags Rule lists categories of possible red flags, but you must tailor them to your dealership. Common red flags in sales and F&I include:

• ID that appears altered, forged, or inconsistent with the customer’s appearance
• Inconsistent information between the credit application, credit report, and ID
• Multiple recent inquiries or trade lines inconsistent with the customer’s story
• Use of a temporary address, hotel, or mail drop as a residence
• Customer cannot recall basic information on the application or credit report
• Mismatch between the customer’s stated employer and verification contact
• Alerts, freezes, or fraud warnings on the credit report
• Requests to rush delivery or take delivery without normal verification steps
• Unusual behavior, such as reluctance to provide ID or income documentation

Also consider red flags related to existing accounts, such as:

• Requests for address, email, or phone changes followed immediately by credit use
• Customer disputes about charges or accounts they do not recognize
• Returned mail or undeliverable notices combined with active account use

Include dealership-specific examples in your written program and training materials.

Step 5: Detection Procedures in Sales and F&I

Your FTC Red Flags Rule identity theft prevention program must explain how you will detect red flags during routine business. For auto dealers, this typically means:

• Verifying the authenticity of driver licenses and other IDs
• Comparing customer information against credit reports and application data
• Using fraud detection tools offered by credit bureaus or lenders when available
• Requiring a second review for high-risk deals (e.g., high-dollar, out-of-area buyers)
• Confirming employment and income using reliable sources

Integrate detection steps into your standard deal checklist so they are performed consistently. Examples:

• F&I manager completes an “Identity Theft Checklist” for every deal
• Sales staff obtain and scan ID before test drives and deliveries
• Collections staff verify identity before processing major account changes

Step 6: Response Procedures When a Red Flag Appears

Your program must describe how the dealership will respond to detected red flags. Responses should be risk-based and may include:

• Collecting additional identification or documentation
• Contacting the customer using a verified phone number or address on file
• Contacting the lender or finance source before funding
• Not opening the account or not completing the transaction
• Closing an existing account or limiting further use
• Notifying appropriate law enforcement when warranted
• Filing required reports (such as suspicious activity reports, when applicable)

Document each response in the deal jacket or account file. When you decide that a red flag is resolved, clearly note why and who approved the decision.

Step 7: Service Provider Oversight

The FTC Red Flags Rule requires appropriate oversight of service providers that handle customer information or perform activities related to covered accounts. This may include:

• DMS and CRM vendors
• Third-party finance companies and subprime lenders
• Credit report providers and lead generators
• Electronic contracting and e-signature platforms

Your written program should explain how you:

• Select service providers with appropriate data security and identity theft controls
• Include Red Flags Rule and data security clauses in contracts where feasible
• Monitor vendor performance and address any incidents

Service provider oversight also supports your obligations under the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule and California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA). See GLBA Safeguards guidance: FTC Safeguards Rule, and CCPA/CPRA rights information from the California Attorney General: California Privacy – CCPA/CPRA.

Step 8: Staff Training and Ongoing Awareness

The effectiveness of your FTC Red Flags Rule identity theft prevention program depends on staff training. At a minimum, provide training for:

• Sales personnel (ID verification, test drive procedures)
• F&I managers (application review, credit report analysis, funding conditions)
• Office and title clerks (record verification, address discrepancies, title fraud)
• Collections staff (verification for account changes and payments)

Training should cover:

• Key requirements of the Red Flags Rule
• Your dealership’s written program and checklists
• Common red flags and realistic examples from your own deals
• How and when to escalate concerns to management or compliance
• Documentation expectations when a red flag is detected

Keep attendance records, training materials, and test results (if any) in your compliance file. These records help demonstrate compliance during regulator or lender audits.

Step 9: Recordkeeping and Audit-Ready Documentation

Strong recordkeeping is essential to show that your identity theft prevention program is more than a “paper policy.” Build documentation into everyday processes, including:

• Written policies and procedures with version control
• Completed identity theft checklists for each deal
• Copies of IDs and supporting documentation, consistent with privacy and retention rules
• Notes describing detected red flags, responses, and resolutions
• Training sign-in sheets, agendas, and materials
• Vendor due diligence documents and contracts
• Annual program review reports and approvals

Organize these records in a way that allows you to respond quickly to lender, DMV, or other audits. Remember that record retention may also be governed by federal and California law, including GLBA and state records requirements.

Step 10: Annual Review, Updates, and Approval

The Red Flags Rule requires periodic updates to your program to reflect changes in risks and your operations. At least annually, your dealership should:

• Review identity theft incidents and near-misses from the prior year
• Evaluate the effectiveness of detection and response procedures
• Consider changes in products, services, vendors, or technology
• Update red flags, checklists, and procedures as needed

Senior management or the dealership’s board/owner should approve major changes and receive an annual report on the program. The FTC explains that oversight by the board of directors or senior management is part of a compliant program structure. See: FTC Red Flags Rule Program Requirements.

Integrating Red Flags Rule Compliance with GLBA and California Privacy Laws

Your Red Flags Rule program should not operate in a vacuum. Auto dealers that are “financial institutions” under GLBA must also comply with the GLBA Privacy Rule and Safeguards Rule, which require protecting customer information and providing privacy notices. Official guidance is available at: FTC GLBA Privacy Rule and FTC GLBA Safeguards Rule.

California dealers must also consider obligations under the CCPA/CPRA, including transparency, consumer rights, and data security expectations. The California Attorney General provides business guidance and FAQs at: CCPA/CPRA Guidance.

Aligning your Red Flags Rule identity theft prevention program with GLBA and CCPA/CPRA helps create a unified customer data privacy and security framework.

Practical Tips for Auto Dealer Implementation

To make your FTC Red Flags Rule identity theft prevention program work in real life:

• Assign a clear program administrator with authority to enforce procedures
• Embed checklists and verification steps into your DMS or deal software when possible
• Use scenario-based training with real examples from your dealership
• Coordinate with your lenders on identity theft prevention expectations
• Review deals that resulted in chargebacks, fraud losses, or complaints and update your program accordingly

By building a tailored, well-documented program, California auto dealers can protect customers, reduce fraud losses, and demonstrate strong compliance to lenders, regulators, and consumers.

Sources

• FTC – Financial Institutions and Creditors: Are You Covered by the Red Flags Rules?
• FTC – How To Comply with the Privacy of Consumer Financial Information Rule (GLBA Privacy Rule)
• FTC – Complying with the Safeguards Rule
• California Department of Justice – California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)