2. Red Flag Training IDENTITY THEFT PREVENTION PROGRAM OVERVIEW AUTOMOTIVE

3. Red Flag Training What is the Red Flag Ruling? The Red Flag Ruling requires automotive dealerships to implement policies and procedures to prevent fraud due to identity theft. The Ruling Implements Sections of 114 and 315 of the FACT Act of 2003 This section of the Fair and Accurate Credit Transactions Act contains 26 “red flags”, many of which are applicable to automotive dealerships A “red flag” is a pattern, practice or specific activity that indicates the possible existence of identity theft The Red Flag Ruling requires dealerships to identify any red flags that apply, have a process in place to detect red flags, outline proper responses to those red flags detected, train all applicable staff and to update the program on a regular basis to assure maximum compliance with the regulation requirements Compliance is Mandatory as of November 1, 2008

4. Red Flag Training What is Identity Theft? Identity theft occurs when someone uses personal identifying information belonging to someone else to commit fraud or other crimes. Automobile dealerships must protect all consumer information they possess and now are required by the Red Flag ruling to make sure no one uses another persons identity to finance a car. If identity theft occurs at your dealership, substantial federal fines and penalties may be assessed as well as civil lawsuits filed by the victims. The dealership may also lose a car.

5. Red Flag Training Identity Theft Prevention Program Your dealership has implemented a comprehensive program in order to achieve compliance with the Red Flag Ruling. It includes: - Written Identity Theft Prevention Policies & Procedures Manual - Training for Applicable Staff - NCC’s Proof of Identity Solution - NCC’s Authentication Solution Understanding and following the outlined procedures is key to your dealership achieving compliance with the regulation.

6. Red Flag Training The Objectives The compliance program requires 4 key elements: Identify, Detect and Respond to Red Flags and Update the program to keep pace with the current methods of Identity Theft. Management will be primarily responsible for the identification of the red flags, keeping staff trained and updating the program. Sales and Finance staff will be responsible for the detection of and response to any red flags noted during the application process.

7. Red Flag Training Identify Red Flags There are 26 potential Red Flags identified in the ruling. However, only certain Red Flags pertain to this dealership. When your training is complete you should be able to recognize and respond in the proper manner to the identified Red Flags. Some of these flags will be familiar to you and detecting them may already be part of your dealership’s application screening process.

8. Red Flag Training Red Flag Identification The Red Flags on this screen require manual observation. Please slow down and take the time required to examine all identification and documents provided by the applicant(s). Proper responses will be outlined in the Training Guides. SUSPICIOUS PERSONAL IDENTIFYING INFORMATION OR DOCUMENTS Using the applicant’s driver’s license, look for the following red flags… Documents provided for identification appear to have been altered or forged. The photograph or physical description is not consistent with the appearance of the customer presenting the identification. Other information (age, height, eye color) on the identification is not consistent with information provided by the person applying for credit or the person presenting the identification. The customer applying for credit fails to provide all required personal identifying information on an application or in response to notification that the application is incomplete or is unable to be completed.

9. Red Flag Training NCC’s Proof of Identity Solution The dealership has selected to use NCC’s Proof of Identity Solution as the first of two additional tools to aide in responding to a detected Red Flag. The NCC Proof of Identity Solution is a web based system that matches the information provided from the consumer against the credit bureau's data and other outside data sources. Results will show if information matches, is a partial match or no match. The POI Training Guide will provide complete training on using the Proof of Identity system to detect Red Flags.

10. Red Flag Training Personal identifying information provided is inconsistent when compared against external information sources. An address does not match any address in the consumer credit report The Social Security Number (SSN) has not been issued, is newly issued or is listed on the SS Administration's Death Master File The SSN issuance date pre-dates the applicants birth date Applicant is unable to identify the SSN state of issuance Personal identifying information provided by the customer is not consistent with other personal identifying information provided by them, such as the lack of correlation between the SSN range and date of birth. Red Flag Identification

11. Red Flag Training Personal identifying information provided is associated with known fraudulent activity as indicated by internal or third-party sources. The address on an application is fictitious, a mail drop, a prison or has been associated with fraudulent activity The phone number is invalid, or is associated with a pager or answering service The social security number has been reported as used by multiple individuals or has been used in fraud Red Flag Identification (Continued)

12. Red Flag Training ALERT, NOTIFICATION OR WARNING FROM A CONSUMER REPORTING AGENCY An active duty alert is included with a consumer report A fraud alert is included with a consumer report A consumer reporting agency provides a notice of credit freeze in response to a request for a consumer report A consumer reporting agency provides a notice of address discrepancy (a substantial difference between the address for the consumer that the user provided to request the consumer report and the address in the agency's file for the consumer) Red Flag Identification (Continued)

13. Red Flag Training A consumer credit report indicates a pattern of activity that is inconsistent with the history and usual pattern of activity of an applicant, such as: A recent increase in the volume of credit inquiries An unusual number of recently established credit relationships An account that was closed for cause or identified for abuse of account privileges by a financial institution or creditor A material change in the use of credit, especially with respect to recently established credit relationships Red Flag Identification (Continued)

14. Red Flag Training NCC’s Authentication Solution As the second tool to aide in responding to a detected Red Flag, the dealership has selected NCC’s Authentication Solution. This solution is a web based system that generates unique non-credit bureau based questions for each applicant. The applicant’s ability to correctly answer the four questions will assist you in determining their true identity. Contact senior management if further verification is required. The Authentication Solution generates a new set of four questions each time it is used. Senior management will determine if a second round of questions would benefit in a final authentication attempt.

15. Red Flag Training What’s Next… You’ve just completed the first part of your training! The next steps are: 1. Review the Proof of Identity Solution Training Guide 2. Review the Authentication Solution Training Guide