By now, most dealers have an Identity Theft Prevention Program in place as required by the Federal Trade Commission (FTC)’s Red Flags Rule since 2008. Many of you have heard about recent changes to the rule and have asked if the rule no longer applies to dealers. The short answer is “No,” but let me tell you why.

As a recap, the rule requires that financial institutions and creditors (dealerships who finance vehicles on retail installment sales contracts, or RISC, are creditors) develop and implement a written program that is designed to detect, prevent and mitigate identity theft in connection with the opening of an account or any existing account. The prevention program must be appropriate to the size and complexity of the dealership and the nature and scope of its activities.

There are required elements that must be part of your program, including reasonable policies and procedures to identify the Red Flags that are relevant to the kinds of accounts you offer; detect the Red Flags you’ve incorporated into your program; respond appropriately to any Red Flags that are detected to prevent and mitigate identity theft; and ensure the program (including the Red Flags determined to be relevant) is updated periodically to reflect changes in risks to customers and to ensure the safety and soundness of the dealership.

In the original release of the rule, the FTC defined “creditor” in an overly broad manner. A “creditor” was “any person who regularly extends, renews or continues credit; any person who regularly arranges for the extension, renewal or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew or continue credit.” Dealers clearly fell into this definition since most regularly extend or arrange credit for their customers who finance their vehicle purchases.  

Of course, in order to be a creditor, someone has to get “credit,” and it was the definition of “credit” that created the real problem. Paying the plumber after she fixes your drain or paying the neighbor next door after he mows your lawn was, in the eyes of the FTC, an extension of credit, i.e., “the right granted by a creditor to a debtor to defer payment of debt or to incur debts and defer its payment or to purchase property or services and defer payment therefore.”

From the FTC’s perspective, if you waited to pay for a service until after it was completed, you had received an extension of credit. So, the example of the plumber or 14-year-old neighbor who mows your lawn comes into play. It would also encompass a restaurant that presented the bill after you completed your meal, the dry cleaner who charges you after the clothes are cleaned, etc. Can you imagine having to prove your identity before you can order a meal at Applebee’s? Yeah, me either.

Congress thought this was ridiculous and moved to narrow the world of creditors by narrowing the definition. They added three additional factors limiting the definition of a creditor. Only one applies generally to dealers and says “any person who regularly obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction.”  

Simply put, not much has changed. Most dealerships will still need to maintain their programs, at least to the extent they regularly obtain or use consumer reports. By adding the qualification “directly or indirectly,” the new definition captures dealers who may not obtain credit reports themselves, but who forward applications to finance sources that obtain or use credit reports, which is virtually all of them. With the exception of some buy-here, pay-here operators, dealers who were covered by the original rule remain covered under the revised rule.

For most dealers, nothing has changed. Keep your programs up to date and intact, and make sure they are being applied appropriately. The good news is that for those fancy dealerships that serve hot dogs or other treats or meals (and who make the customer pay for it), it will no longer be necessary to verify the identity of your customer before you hand over the hot dog. You can wait until they actually apply for credit.

Michael Benoit is a partner in the Washington, D.C., office of Hudson Cook LLP. He is a frequent speaker and writer on a variety of consumer credit topics. He can be reached at michael.benoit@bobit.com. Nothing in this article is legal advice and should not be taken as such. Please address all legal questions to your counsel.