By now, most dealers are aware of the FTC’s Red Flags Rule and the potential liability they face if they do not adopt and implement an Identity Theft Prevention Program required by the Rule. Countless mailings, webinars and other communications from compliance gurus have certainly raised the awareness level. But there is a very real back-end risk that dealers face in the Red Flags Rule that few, if anybody, are talking about. That is the risk of lenders evaluating charged-off accounts under their Red Flags Program and identifying which of those accounts—even ones that have paid for a time—involve identity thieves. Dealers risk lenders demanding repurchase of these accounts months or maybe even years down the road as most lender agreements force dealers to warrant the legitimate identity of the customer, at least for some period of time.

This risk involves principally what is called “synthetic” identity theft. Synthetic identity theft occurs when the thief gets access to your Social Security number and perhaps your birthday and sets up their own identity using your SSN and a birthday that is very close to yours (this to make the Social seem legitimate as Social Security numbers can be traced to approximate time of issue). Synthetic identity theft is how illegal immigrants, deadbeat dads, and the kind of people you see on “America’s Most Wanted” get fake identities and it’s not hard to do. Credit bureaus routinely set up credit files on 20 or more people under the same Social Security number. With 12-24 million illegal immigrants in the country and the IRS reporting 8-11 million people to the Social Security Administration each year who are using someone else’s Social, synthetic identity theft is a very real problem. It accounts for up to 88% of all new identity theft according to a 2005 ID Analytics study.

In the past, lenders would write off as credit losses those accounts that paid for a time and then simply stopped paying. The customer might disappear and the vehicle might disappear with him or her but the prior payment history made dealers vulnerable to repurchase requests on few, if any, of these accounts. The Red Flags Rule changes all that.

Lenders under the Red Flags Rule have to run their Red Flags Program against accounts in their portfolio for the purpose of detecting, preventing, and mitigating identity theft. That includes accounts they are writing off at any point in the account’s lifecycle. As anyone who has ever worked in the credit card industry well knows, banks are very good at developing behavioral algorithms to predict fraud and other illicit behavior. It won’t take them long to develop models that identify synthetic identity thieves or they may just run a batch of accounts against an electronic identity verification service. Many accounts that previously would have just been written off as credit losses now are going to produce some synthetic identity theft accounts and that may give lenders the basis to force you to repurchase the account. That’s the hidden land mine at the back end of the Red Flags Rule. An account you sold to a lender 16 months ago could suddenly come back with a demand for repurchase and no vehicle in sight.

The repurchase liability of dealers varies by lender and this would be a good time to review your lender agreements to see if you can identify those lenders where your repurchase risk is the greatest. It is not unreasonable to include a provision in the repurchase section that excuses your obligation if you can show you have adopted and implemented a robust Red Flags Identity Theft Prevention Program and a sufficient period of time has passed from the account origination. After all, the Red Flags Rule is not supposed to make anyone a guarantor against identity theft and implementing a good Identity Theft Prevention Program is really all you can do. One dealer I recently spoke with told me that when a lender demanded he repurchase a synthetic identity theft account that went bad after about six months, he pointed to his Red Flags Program and diligence in executing it against the customer. The lender then backed off even though they had the legal right to require repurchase. Business relationships still do count for something these days.

You also need to give careful thought under your program when you suspect the customer may be a synthetic identity thief such as an illegal immigrant. Some indicators may include a very thin but current credit file, a notation from your electronic identity verification service that the customer’s use of this Social Security number is questionable, and the customer’s inability to answer correctly all of the “out-of-wallet” or challenge questions you get from your electronic identity verification service. If you are not using an electronic identity verification service, ask the customer where they lived when their Social Security number was issued. If they are under age 25, just ask them what state they were born in. The first three digits of a Social correlate to a state and the state is where the person lived when their Social was issued. The list of state-assigned originating three-digit numbers as well as three-digit originating numbers that have never been used by the Social Security Administration is available at the Social Security Administration’s web site at http://www.socialsecurity.gov/employer/stateweb.htm. If the customer names the wrong state for the initial three digits of their Social Security number, that is a big red flag.

At the end of the day, a dealer’s biggest financial risk under the Red Flags Rule may not be the FTC or an Attorney General coming through the front door. It is likely to be your lenders scrutinizing accounts they have bought from you that have gone bad and forcing you to repurchase. Remember, the Red Flags Rule took effect last November 1 so arguably any account originated after that date is fair game.  Illegal immigrants buy cars as do other synthetic identity thieves and if you sell one to them, you are taking a repurchase risk possibly for the full term of the credit obligation. Since repurchasing involves paying off the account with the vehicle probably long gone, it doesn’t take many repurchases to add up to big dollars.

So be aware that your lenders, and not the FTC, may be your biggest Red Flags financial risk and make sure to adopt and consistently implement an effective Red Flags Program so you can at least argue that you were diligent and did all you could do. You may also want to ask your attorney to help you renegotiate some of the more onerous repurchase provisions in your lender agreements. Try to make your customer identity warranty to the best of your knowledge after commercially reasonable investigation and terminate the repurchase obligation 12-18 months after the account is purchased by the lender. Remember, the Red Flags Rule was never intended to make you a guarantor and I think that is the argument I would pursue with lenders, assuming my own dealership Red Flags house was in order.