Get a demo
Get a demo
Get a demo
Red Flags Rule

Red Flags Rule Compliance for Dealerships That Extend Credit

REQUEST DEMO

One platform that ensures smarter deals & safer sales for your business.

Fraud Prevention
Customer insights
Credit Solutions
SmartPencil
Payments API
Credit Compliance
Dealership Compliance Software
Total Solution

If your dealership finances purchases, directly or through third-party lenders, you are a creditor under the FTC’s Red Flags Rule and are required by law to maintain a written Identity Theft Prevention Program.

The Red Flags Rule is not new. It has been in effect since January 1, 2008 but enforcement has increased alongside the broader FTC Safeguards Rule compliance push, and the tools available to identify thieves have grown significantly more sophisticated in the years since.

What the Red Flags Rule Requires

The Red Flags Rule requires covered creditors to develop and maintain an Identity Theft Prevention Program built around four core principles:

  1. Identify the red flags most relevant to your dealership based on the accounts you offer and your history with identity theft
  2. Detect red flags as part of your day-to-day operations
  3. Respond appropriately when red flags are detected
  4. Update the program regularly to keep pace with evolving threats

The program must have designated oversight and include staff training. Informativ’s compliance platform enables dealerships to meet these requirements by automating red flag detection and response across every deal so your team stays protected without slowing down the sales process.

What Counts as a "Red Flag"

A red flag is any pattern, practice, or specific activity that indicates possible identity theft. The FTC organizes red flags into several broad categories, including alerts and warnings from consumer reporting agencies, suspicious documents, suspicious personal identifying information, unusual account activity, and notices from customers or law enforcement.

Red Flags and Your Credit Workflow

The most direct way to detect and respond to Red Flags is to automate their detection within your credit workflow. Informativ surfaces Red Flags alerts automatically within every credit pull:

  • Fraud alerts and credit freezes – flagged when present on the applicant’s credit report
  • Deceased indicators – flagged when the applicant’s SSN is associated with a deceased individual
  • Address discrepancies – flagged when the address provided does not match credit bureau records
  • Synthetic ID indicators – SSN-to-name mismatches and thin credit histories inconsistent with the applicant’s stated age and history
  • Suspicious document indicators – flagged through ID authentication when the presented document does not pass verification

When a Red Flag is detected, the alert appears in the workflow before a credit decision is made. Your team can then apply the appropriate response such as additional verification, out-of-wallet questions, document re-collection, or declining to proceed.

All alerts and responses are logged automatically for compliance documentation.

When a Red Flag is detected, the alert appears in the workflow before a credit decision is made. Your team can then apply the appropriate response such as additional verification, out-of-wallet questions, document re-collection, or declining to proceed.

All alerts and responses are logged automatically for compliance documentation.

Required Response to Red Flags

Detection alone is not compliance. When a Red Flag is detected, you must respond. The appropriate response depends on the type and severity of the flag, and your written program should specify the response procedures for each category.

Typical responses include:

  • Requesting additional identity verification (out-of-wallet questions, secondary ID)
  • Contacting the customer to verify the information
  • Not opening the account until identity is confirmed
  • Declining the transaction
  • Notifying law enforcement if identity theft is confirmed

Informativ’s out-of-wallet verification is designed specifically for the additional identity confirmation step, providing a layer of verification that does not require the applicant to produce another document that could also be falsified.

Documentation and Program Updates

Your Identity Theft Prevention Program must be documented in writing and updated periodically. Documentation should include:

  • The written program itself, including identified red flags and response procedures
  • Evidence of senior management approval
    Staff training records
  • A log of red flags detected and responses taken
  • Records of service provider oversight

Informativ logs every red flag detected, every alert reviewed, and every response action taken within the workflow. This documentation supports your program’s recordkeeping requirements without a separate manual process.

Red Flags Rule vs. FTC Safeguards Rule

The Red Flags Rule and the FTC Safeguards Rule are related but separate requirements:

Maintaining a compliant program for each requires separate documentation, though the underlying tools and workflows often overlap significantly.

Red Flags Rule FTC Safeguards Rule
Governing Authority
FTC (FCRA / FACTA)
FTC (GLB Act)
Primary focus
Identity theft detection and response in covered accounts
Comprehensive information security program for customer financial data
Applies to
Creditors with covered accounts
Financial institutions handling nonpublic personal information
Requires
Written Identity Theft Prevention Program
Written Information Security Program (WISP)
Red Flags Rule
Governing Authority
FTC (FCRA / FACTA)
Primary focus
Identity theft detection and response in covered accounts
Applies to
Creditors with covered accounts
Requires
Written Identity Theft Prevention Program
FTC Safeguards Rule
Governing Authority
FTC (GLB Act)
Primary focus
Comprehensive information security program for customer financial data
Applies to
Financial institutions handling nonpublic personal information
Requires
Written Information Security Program (WISP)

Frequently Asked Questions:

The Red Flags Rule applies to “financial institutions” and “creditors” that maintain “covered accounts.” Most dealerships that facilitate financing, whether through direct lending, deferred payment arrangements, or lender submission, qualify as creditors. Consulting with compliance counsel on your specific situation is advisable if you are uncertain.
A covered account is either a consumer account primarily used for personal, family, or household purposes that involves multiple payments or transactions, or any other account for which there is a reasonably foreseeable risk of identity theft. Vehicle financing accounts typically qualify under both definitions.
The FTC does not specify a frequency. The requirement is that the program be updated to reflect changes in risks, new identity theft threats, your experience with identity theft in your accounts, and changes in your business operations. Annual review is a common practice.
The FTC can bring enforcement actions against dealers who fail to comply. Penalties can include civil monetary penalties and corrective action orders. Individual states may have additional requirements.

Yes. The requirement applies to covered accounts regardless of how they are opened or maintained. Online and remote credit applications are covered.

Yes, if those tools are implemented as part of a formal Red Flags program. Running fraud detection is not automatically the same as having a compliant Red Flags program. The requirement is that detection and response are part of a written, documented, and supervised program. Informativ’s workflow supports that program, but the written program itself is your responsibility to maintain.

Your Red Flags Program Shouldn’t Run on Spreadsheets

REQUEST DEMO