Lornamatic has posted a fabulously written story of a terrible customer experience at a car dealer run by Hitchcock Automotive. In a nutshell the dealer demanded a thumbprint to seal the sale of a car but did not provide any assurance to the customer about the safety or use of the thumbprint, and so the customer did the right thing and walked away.

I wonder if the dealer will soon run ads that say

Give us the finger and we’ll give you a car!

Good thing I never went into marketing, eh?

The story is really well done and definitely worth reading. I won’t give it away because I don’t think I can do it justice, but I will comment on a comment at the end of the story because it is rather funny and ironic. Someone who signed their comment as Andy wrote:

I’m assuming the good folks at that dealership are doing the best they can and are not interested in framing you

Right. First of all the risk is not being framed. The risk is losing your fingerprint to an identity thief. Then what? Get a new hand? Second, should someone really believe that gosh-darn kind-hearted car dealers are just good folks who have your best interests at heart? I suppose they also ride unicorns to work. But let’s dig a little deeper…

My point is simply that Andy’s point is really no point at all. It’s the equivalent of saying “trust the trustworthy and you’ll have no problems”. What makes dealers inherently good? Or what makes their information management practices worthy of you handing them identity information? I’ve worked on computers in some dealerships and let me tell you it is about as far from pretty as you can get.

Maybe customers should be fingerprinting the dealers. Literally. Who knows how long those shifty-eyed sweaty-palmed sales folks in plaid suits and shiny white shoes have been working or where they came from? A dealer might do their best to avoid hiring a grand-theft perpetrator (to protect their own assets), but do they care if someone has just been released after serving time for identity theft? Identity theft (especially biometric data) is external to the dealer. Thus, someone other than the dealer HAS to put a burden upon them to prove they will do NO harm to things given to them for safekeeping that they do not personally value. And if they can not provide the assurance, then they should be able to transfer the risk (e.g. to an insurance company or underwriter) or reduce the value of the asset, etc..

OK. Given all that usual risk assessment stuff I feel I should point out that a Regional Auto Theft Task Force (RATTF) does in fact exist. I tried posting this on Lornamatic’s site, but I failed the anti-spam math test. :) Lornamatic mentioned not being able to find a reference, but take for example the Santa Clara RATTF, which published this interesting report about an area close to Lornamatic’s dealer:

In most of the cases, the individual suspect presented false employment information on a credit application, reflecting a lengthy employment history and sufficient monthly income. In the majority of these cases, this information would be corroborated by what appeared to be legitimate paycheck stubs, later found to be completely counterfeit. In fact, the majority of the suspects had no legitimate source of income. The business addresses were more often than not determined to either be vacant properties, or in some cases, actual functioning businesses, which had no record of such persons ever being employed. Postal mail drop services were also utilized in this process; helping to provide what appeared to be a legitimate local address for several of these suspects.

Among those businesses victimized by these criminals, were Capitol Honda, Courtesy Chevrolet and Chris’ Dodge World. Lending institutions included American Honda Finance, San Jose Credit Union and Bank of America.

RATTF investigators determined that this group of suspects obtained at least 113 new vehicles in this fraudulent manner, valued at approximately $2.3 million. Of the 105 suspects eventually identified, Task Force detectives have thus far been successful in obtaining 85 criminal complaints, charging various felonies including Grand Theft, Making a False Financial Statement, Perjury and Insurance Fraud. In addition to warrants resulting from the vehicle scams, several of these suspects have been arrested for robbery, financial elder abuse and other theft related cases. At least a dozen more cases are pending complaints as of this writing. Approximately 80% of the vehicles have been recovered as a result of these investigations. Vehicles have been recovered in New Jersey, Texas, Arizona, California, Washington and Florida.

For some incredibly short-sighted reason the perpetrators are being described as “nomadic criminals”. This weighted reference to people who do not want to (or can’t) “own” land and stick to it is a topic for another day:

Somalis have long debated the merits of a nomadic, pastoral existence versus those of a settled agricultural community.

Perhaps from the dealer’s standpoint, the threat is potentially so high and the identity verification system so vulnerable that they really do not mind turning away the odd customer in order to avoid the risk of a stolen car. The sad thing is the way Hitchcock Automotive handled their security, and in particular how they handled Lornamatic’s genuine concerns.