At a glance
- Who it's for
- Dealers who arrange financing and buy-here-pay-here dealers who hold their own accounts.
- What you need
- A written program, approved by the owner or board
- Small business exemption
- None, though a simpler program can fit a low-risk store
- Rule
- 16 CFR 681.1
On this page
Does the Red Flags Rule apply to car dealers?
The rule covers "creditors" with "covered accounts". It uses the definition in the Fair Credit Reporting Act (15 U.S.C. 1681m(e)(4)): a creditor under the Equal Credit Opportunity Act that regularly obtains or uses credit reports in connection with credit, furnishes information to credit bureaus, or advances funds to be repaid. Regulation B calls a business a creditor if it "regularly participates in a credit decision, including setting the terms of the credit."
The rule lists "automobile loan" as an example of a covered account (681.1(b)(3)), and the FTC's guide says the creditor test is "based on conduct" and asks whether a business "grants or arranges credit."
No FTC page says "auto dealers are covered" in those words. Our reading is that a dealer who pulls credit reports and sets or negotiates contract terms meets the test, and most dealers who arrange financing treat themselves as covered. Buy-here-pay-here dealers who hold their own accounts are plainly creditors.
What the written program must do
Under 16 CFR 681.1(d), the program has reasonable policies and procedures to:
- Identify the Red Flags that matter for your accounts.
- Detect them when they show up.
- Respond to them, to prevent and reduce identity theft.
- Update the program from time to time as risks change.
It must fit "the size and complexity" of your business. Before writing it, check whether you offer covered accounts (681.1(c)).
Red Flags a dealership sees
| Kind of Red Flag | At the desk, it looks like |
|---|---|
| Alerts from a credit bureau | A fraud alert, a credit freeze, or a notice that the address doesn't match |
| Suspicious documents | A license that looks altered, or a photo that doesn't match the buyer |
| Suspicious personal information | A Social Security number that doesn't fit the credit file, or an address that is a mail drop |
| Unusual account activity | Payments stop right after delivery, or mail comes back on a new account |
| Notice from a victim or the police | A call saying someone bought a car in their name |
These are the categories in Supplement A to Appendix A of 16 CFR Part 681. Your program picks the flags that fit your store.
Running the program
Under 681.1(e):
- The board, a board committee, or a senior manager if there is no board approves the first written program.
- The board or senior management stays involved in overseeing it.
- Staff are trained "as necessary".
- Service providers that handle your accounts are overseen.
The guidelines in Appendix A say staff "should report ... at least annually" on how the program is working. That is guidance, which the rule asks you to consider.
If you pull credit, a separate rule (16 CFR Part 641) covers address discrepancy notices from the credit bureaus: have a way to confirm the report is about your buyer, such as checking their ID.
Rules checked and limits
Rules checked October 31, 2026. We read every rule on this page in the eCFR or on the agency's own site, and each is linked in the sources below. We re-check them every quarter.
Templates and tools, not legal advice. CarShots is software, not a law firm. For a question about your own dealership, ask your attorney or your state dealer association.