COUNSELOR’S CORNER “Ghost Buyers” and Synthetic Identity Fraud What Illinois Dealers Can Do About It Julie Cardosi, Esq. Law Office of Julie A. Cardosi, P.C. The customer has a clean credit file, a 700-plus score, a valid-looking driver’s license and a down payment in hand. The deal funds. A few payments later, the account goes silent, the vehicle is gone, and the lender calls with a question no dealer wants to hear: Who did you actually sell that car to? Increasingly, the answer is no one. Synthetic identity fraud, the creation of a fictitious person from a blend of real and fabricated data, is one of the fastest-growing forms of financial crime in the United States, and auto finance is a favored target. For Illinois franchised dealers, the exposure is both financial and regulatory. How a Synthetic Identity Is Built Unlike traditional identity theft, where a criminal impersonates a real person, synthetic fraud invents a new one. The fraudster typically pairs a real Social Security number, often belonging to a child, an elderly person, or someone deceased, with a made-up name, date of birth, address and phone number. Even a declined credit application can create a credit file. The fraudster then cultivates that file, sometimes for years, by adding the identity as an authorized user on established accounts (“piggybacking”), opening small secured cards and paying on time. Once the profile looks creditworthy, the “bust-out” begins. Vehicles are attractive because they are high-value, portable and easy to resell, export or part out. And because there is no real victim to dispute the account, synthetic fraud often goes undetected until default, when it is frequently written off as an ordinary credit loss. Why It Lands on the Dealer Many dealers assume the lender owns the risk once a retail installment contract is assigned. Not necessarily. Dealer-lender agreements commonly include representations and warranties regarding the accuracy of the credit application and the buyer’s identity, backed by repurchase obligations if those representations prove false. A pattern of bad deals can also strain or end valuable lender relationships. Regulators also expect dealers to be part of the defense. Dealers that arrange financing are “creditors” under the FTC’s Red Flags Rule, which requires a written Identity Theft Prevention Program to detect, prevent and mitigate identity theft. The FTC’s amended Safeguards Rule separately requires a written information security program, a designated qualified individual to oversee it, and notice to the FTC of certain security events affecting a threshold number of consumers. In Illinois, the Personal Information Protection Act layers on state breach-notification duties. Practical Steps to Combat Synthetic Fraud 1. Refresh your Red Flags program. Many dealer programs were adopted years ago and never revisited. Update yours to address synthetic indicators specifically, including thin or recently established credit files paired with high scores, multiple authorized-user tradelines, a credit history that seems too short for the applicant’s age, and addresses, phone numbers or emails shared across unrelated applicants. 2. Verify beyond the license. Use ID authentication tools that scan barcodes and verify security features rather than relying on visual inspection. Ask your lenders and vendors whether they validate the name, date of birth and Social Security number combination, including via the Social Security Administration’s electronic Consent-Based SSN Verification (eCBSV) service. Confirm that phone numbers and emails actually belong to the applicant. 3. Train sales and F&I staff on behavioral red flags. Watch for indifference to price or terms, pressure to rush the deal, a third party answering questions for the buyer, requests for off-site delivery, and a fixation on high-value or easily exported models. Your people are the one control a fraudster cannot fully script around. 4. Mind BIPA before adopting biometrics. Selfie-matching and facial verification tools can be effective, but in Illinois they implicate the Biometric Information Privacy Act (“BIPA”). 14 ILLINOIS AUTOMOBILE DEALER NEWS
RkJQdWJsaXNoZXIy MTg3NDExNQ==