Attorneys are not like normal people. When normal people wake up in the middle of the night, they think about sex, money troubles or the burritos they ate before going to bed. But not attorneys. They think about the hidden meaning of 16 CFR 681, Appendix A, Part IV. At least this one does.

Let me explain. 16 CFR 681 is commonly known as the Red Flags Rule. It applies to most financial institutions and, because most car dealerships originate financing, it applies to most dealerships. Whether or not the FTC officially begins its oft-delayed enforcement of the Rule on Jan. 1, 2011, it has been in effect since Jan. 1, 2008.

The Rule itself contains 4,074 words; I boil the Rule’s requirements down to seven:

1. Policy (an Identity Theft Prevention Program (“ITPP”), to be exact)

2. Training (staff on how to effectively implement the ITPP

3. Detect (attempts at identity theft)

4. Prevent (instances of identity theft)

5. Mitigate (the effects of identity theft)

6. Oversee (service provider agreements)

7. Ensure (that the ITPP continues to work over time)

Yeah, I know – George Carlin’s seven words were far more interesting. But these words carry legal requirements, so they deserve special attention. Today, my attention is drawn to “Mitigate.”

The Red Flags Rule clearly requires dealerships to have a policy in place that mitigates identity theft in connection with their “covered accounts.” In a dealership, “covered accounts” would mean installment sale contracts and leases. But what does “mitigate” mean?

Of all 4,074 words of the Rule, not one – not one! – is spent defining one of its seven basic requirements. Except, maybe, Appendix A, Part IV. That section is titled “Preventing and Mitigating Identity Theft.” The problem is, you can’t tell if the text that follows is addressing prevention or mitigation. And more to the point, if the dealership faithfully followed all of the suggestions in Appendix A, Part IV, no rational person would believe an identity theft event would have been effectively mitigated.

Appendix A, Part IV lists eight possible actions to prevent and mitigate identity theft (nine if you count the last one – “Do nothing”). Of the eight, only four could apply to an installment sale contract or lease: (b) Contacting the customer; (f) Closing the account; (g) Not attempting to collect on a covered account or not selling a covered account to a debt collector; and (h) Notifying law enforcement.

So the problem is, even if a dealership performs those four tasks, is an identity theft event really mitigated?

Logically speaking, by the time a criminal enters a dealership and attempts to take delivery of a vehicle in a victim’s name, an identity theft has already occurred. What is left to occur is monetary damage flowing from that identity theft. If a thief accomplishes delivery of a vehicle by getting it funded in the victim’s name, mitigation is accomplished in a narrow sense by canceling the financing.

But in a broader sense, mitigation hasn’t really occurred: the victim’s identity is still circulating and capable of being misused again and again, and the dealer now owns the paper. Ouch!

For true mitigation to even begin, at a minimum, a fraud alert must be placed on the victim’s credit file – and the dealership is not required to take that step. Curious. Mitigation would also logically imply investigating what other damage has been done using the stolen identity, and then unwinding that damage to return the identity to its pre-event status.

While the Rule does not require it, granting either every victim or every customer access to identity theft recovery service would provide a more meaningful level of mitigation, and certainly a higher level of customer satisfaction. Before we discuss this service, a couple of definitions would be helpful.

Assisted Recovery is the process of a victim attempting to restore his own identity with the advice of a professional. This advice is usually provided through a “how to” manual and, in some cases, telephone consultations. But the actual tasks necessary to restore an identity are performed by the victim.

Blanket Coverage is where ID recovery services are provided to every member of a defined group, such as every customer of a dealership. Because it is essentially group coverage, blanket coverage is less expensive than individual coverage.

Fully-managed Recovery is the restoration of a victim’s identity to its pre-event status performed by professional identity recovery advocates rather than by the victim. It is accomplished by the victim filling out and providing to the recovery advocate a limited power of attorney, which authorizes the recovery advocate to act on the victim’s behalf. Although the victim must cooperate with the process for it to be successful, the heavy lifting is done by professionals, not the victim.

In the vernacular, assisted recovery isn’t worth a 480 BEACON score in a Lexus dealership. A victim doesn’t want to be told how to fix a problem – he wants the problem solved. And the best way to do that is through a fully managed recovery.

Fully managed recovery by a reputable provider is the gold standard. But if provided after the fact, it is quite expensive. Such ex post facto remediation's generally start in the four-digit range and can go up quickly, depending on the complexity of the case. Blanket coverage – providing the coverage to all finance or lease customers (cash customers aren’t covered by the Rule, but it’s a nice touch) – is the most economical way of providing meaningful mitigation to a dealership’s customers.

Again, this level of mitigation goes beyond the bare requirements of the Rule, but it more clearly accomplishes the Rule’s intent.

Oh, yeah – what about the dealership that had to eat the $45,000 RISC on a vehicle it delivered to the identity thief? Who mitigates that? Answer: nobody. That’s where prevention really comes into play – a good topic for next time.