Dealerships are targets for ID thieves, from inside and outside

Amy Wilson
Automotive News -- December 7, 2011 - 12:01 am ET
Hurley: “Spin master” was top F&I producer.

When Scottsdale, Ariz., police pulled over a vehicle on Sept. 10, 2008, they uncovered a fraud ring with ties to drugs, prostitution -- and a local auto dealership.

"It was basically a forgery mill on wheels," Scottsdale Police Detective Scott Much said.

Inside the car, mixed in with credit card numbers stolen from a telemarketing company, were sales contracts from Henry Brown Buick-GMC-Pontiac in the nearby suburb of Gilbert, Ariz. Police went to the dealership and talked to owner Henry Brown.

Brown, shocked to hear about the security breach, cooperated with investigators. Together they figured out the common element to the sales contracts gone missing: All those customers were handled by finance manager Dominick Hurley.

It's a crime story that law enforcement officials say happens too often -- one that dealers fear and can be reluctant to discuss when it happens at their dealerships and their customers are victimized.

Hurley, then 46, had long worked for area dealerships -- in between prison stints, that is. With 17 felony convictions for such crimes as burglary, credit card theft and drug violations, Hurley was a "career criminal," Much said.

But he also was charismatic and a top producer in the finance department, earning $200,000 or more annually. Even some of the dealership customers who were victimized initially couldn't believe Hurley had been involved in stealing their personal information, the investigator said.

Dealership management, however, already was suspicious, according to police. A General Motors audit of a gift card incentive to truck buyers had turned up discrepancies. Hurley later admitted diverting $28,500 in Lowe's and Best Buy gift cards to himself and another member of the fraud ring, officials said.

Brown did not respond to requests for an interview. But the dealer fired Hurley after that police visit, Much said. Two days after the visit, police stopped Hurley as he was driving away from his home and arrested him. A search of his house and car turned up more customer files.

In all, Hurley stole the personal information of about a dozen customers of Henry Brown Buick-GMC-Pontiac from late 2007 until he was fired the next September, said Maryann McKessy, chief of the Fraud and Identity Theft Bureau of the Maricopa County Attorney's Office.

"He was giving it to his buddies that he was running around with, doing drugs and prostitution," McKessy said. "It was access to a different lifestyle."

The finance manager's buddies used that customer information to apply for store credit cards, lease vehicles and rent hotel rooms. Dealership customers, who learned from the police that their identities had been stolen, had a mess to clean up regarding their financial histories.

"It absolutely screwed with their credit," McKessy said.

In 2010, Hurley agreed to a plea deal in exchange for testifying against the others and was sentenced to 10 years in prison.

McKessy, who has been prosecuting fraud and identity theft for more than 10 years, said it isn't the first time one of her cases has involved a car dealership.

"I hate to say it, but it's a pretty common ground where information is breached," she said.

It's why the auto industry and regulators have worked to crack down on the problem in recent years. Dealerships are targets for identity thieves -- those working from both the inside and outside. And since cars are such big-ticket items and dealers are so vulnerable to bad word-of-mouth, the consequences of such fraud can be devastating.

"A security breach can be a business killer," said Patricia Covington, a partner at law firm Hudson Cook in Maryland. She is a former CarMax deputy general counsel who has been advising dealerships on legal issues for 14 years.

The Red Flags Rule, which went into effect in 2008, requires businesses such as dealerships to identify likely indicators of identity theft and put reasonable detection and response procedures in place. In certain circumstances, dealerships can be fined up to $2,500 for each violation of the Red Flags Rule.

While it has increased dealership compliance and training costs, it also is helping prevent incidents, in part, by increasing awareness, Covington said.

Dave Robertson, executive director of the Association of Finance and Insurance Professionals, agrees that crackdowns like the Red Flags Rule have been beneficial.

"It's still a major problem, but it's not growing as fast," Robertson said.

While no hard numbers are available on identity theft cases specifically involving dealerships, the Federal Trade Commission does report data on consumer complaints to law enforcement and consumer advocacy organizations. Identity theft is the top consumer complaint, according to the FTC, though the number of complaints dropped through 2010 after peaking at 314,521 in 2008. Complaints had fallen to 250,854 by last year.

McKessy, the prosecutor in the Arizona case, says she has seen fewer instances of identity theft related to dealerships in the past five years.

McKessy and dealership advisers say instances can be cut down further with some simple practices.

It can be as low tech as closely examining a customer driver's license and then scrutinizing the person in front of you, they said. If the license says he is 40, ask more questions if he doesn't look 40, Robertson said.

Use the information a Social Security number reveals as another test, Robertson said. The first three numbers correspond to the geographic area. So a finance manager could say: "So you got your card in Illinois," when it really came from Iowa, to see whether the customer knows to correct that information. AFIP has laminated cards available that list Social Security number prefixes and their place of origin.

A dealer who is hiring should ask for references, particularly prior employers, and then call and check those references, Covington said.

Make sure middle managers also are informed on identity theft and prevention tactics, she said.

"The biggest thing a dealer can do is build the culture of awareness about identity theft," Covington said, "so everyone is thinking about it and thinking about preventing it."

While there is increased cost involved in complying with the Red Flags Rule and putting preventive measures in place, the benefits far outweigh the expense, Covington said. A security breach could cost the dealership a lot more in the long run.

Dominick Hurley's criminal history also underscores the need for an employee background check.

That didn't happen when Hurley was hired at Henry Brown, which has since tightened its policies. According to McKessy and Much, the Brown dealership management didn't know the extent of Hurley's felony convictions when they hired him -- but they were aware he had been to prison.

"But this guy is the most magnanimous person you would meet," McKessy said of Hurley. "He's a spin master. That's why he's so good at his job."

Dealers should follow simple rules to prevent ID theft from insiders and outsiders, experts say.
• Perform criminal background checks, possibly even credit checks, of prospective employees.
• Contact references for all job applicants.
• Provide employees extensive and ongoing compliance training.
• Switch to electronic deal jackets to eliminate paperwork.
• Use compliance software to detect discrepancies.
• Conduct regular audits; spot-check deals.
• Inspect dealership computers for suspicious spreadsheet files.
• Block Web sites that help create phony proof of income.
• Lock down computer systems so that customer information can be pulled only 1 record at a time, not in large batches.
• Don't allow customer paperwork to leave dealership premises.
• Carefully compare customer credit application with credit history.
• Test customers with questions about rent payments, mortgage balances or where their Social Security numbers were issued.
• Examine customer documentation carefully; compare driver's license photo with the person sitting in front of you.
You can reach Amy Wilson at awilson@crain.com. Readers are solely responsible for the content of the comments they post here. Comments are subject to the site's terms and conditions of use and do not necessarily reflect the opinion or approval of Automotive News. Readers whose comments violate the terms of use may have their comments removed or all of their content blocked from viewing by other users without notification.

View the original article here

We Turn
Auto Notes Into Cash!


Autobulk.com