Risk Update: Self-Drive Hire Companies Under Attack From Fraudsters

IMPORTANT – PLEASE READ

Recently, some of our clients have reported incidents involving gangs falsely presenting themselves as legitimate companies. The criminals held fraudulent documentation to take on the identities of legitimate companies. The incidents described by victims have all been similar in nature.

You may be targeted by the same gang; you may be targeted by other gangs using a different approach. There are many ways in which vehicle hire fraud is attempted and they’re constantly evolving successfully tackling the growing threat of fraud requires constant vigilance.

To avoid becoming victim to this type of attack, businesses should take the following measures:

Know your customer

• Be wary of urgent hirers
• Learn all you can about your customer
• If they’re new to you, find out more about them
• Never hire to those using first name only
• Don’t hire a vehicle to people reluctant to step up to your hire desk
• Avoid cash payments as these increase the risk and raise potential moral hazard issues; most insurance policies usually require payment to be made by credit card
• Photograph or capture clear CCTV footage of every driver
• If you use CCTV, make sure you’ve notified the Information Commissioner’s Office (ICO), paid the data protection fee, and are complying with requirements Data protection and your business: Using CCTV - GOV.UK (www.gov.uk)
• Never deliver a vehicle to anywhere that isn’t clearly your customer’s premises, unless you are entirely confident about any alternative
• If it doesn’t feel right, follow your gut instinct, don’t hire.

Covering hirers under your own fleet policy

• Cover will only be provided for named drivers
• A fully completed and signed rental agreement is required and an insurance proposal form must be completed and signed prior to each hire period
• Verify the identity and address of the driver by checking two reliable means of identification How to prove and verify someone's identity - GOV.UK (www.gov.uk)
• Check the driver’s licence every time they hire a vehicle using the DVLA database Check someone's driving licence information - GOV.UK (www.gov.uk)
• Ensure the driver meets the insurance qualification criteria stipulated by your insurer
• For company hires, you must additionally carry out two identity checks on the business.https://www.creditsafe.com/gb/en/blog/business/how-to-check-if-a-company-is-legitimate.html

Customer’s own insurance (COI)

• Criminals can present fraudulent insurance documents in the hope that by showing ‘proof’ of COI, there will be less scrutiny of their identity
• Carry out identity checks on drivers and hirers as you would if you were going to insure them under your own fleet policy
• The signed rental agreement must clearly state that the vehicle is to be covered under the COI
• The rental agreement should include a clause or appropriate signed appendix confirming that the hirer will be legally responsible for all costs if their insurance fails for any reason
• A motor insurance certificate that refers to ‘any motor vehicle hired to the policyholder’ is not proof that the vehicle that is being hired will be covered.
• You need to be provided with explicit evidence that cover has been arranged for the vehicle that’s being hired from you.
• A motor insurance certificate provides no information about the level of cover, any restrictions, or the amount of excess. This information needs to be obtained, and you need to be satisfied that the cover provided is adequate.
• If for some reason the vehicle you initially hire needs to be substituted for another one, then you need to once again go down the path of ensuring that the substitute vehicle is properly insured.
• If your rental agreement extends beyond the renewal date of the customer’s insurance policy, make sure the policy is renewed before allowing the customer to continue driving the rental vehicle. Check at least one week before their insurance expiry date. Inspect all documentation thoroughly, check for signs of tampering. If there is any doubt, ring the insurance provider using a number you find yourself (not a number the customer gives you) and seek verification
• Don’t rely on the contingency cover provided under your self-drive hire motor fleet policy. There’s likely to be a substantial coinsurance clause, usually around 25%
• Whether explicitly stated or not, in practice, any contingency cover that may be provided under your own fleet policy may be conditional on you having carried out the same level of checks that you’d carry out if covering the hirer under your own fleet policy.
• Contingency cover will also require you to obtain written confirmation from the customer’s insurer that your vehicle is covered. This will need to include confirmation of the validity and extent of cover on the vehicle for the duration of the hire.

Credit card payments

• Ensure the hirer’s credit card is their own
• If a company wants to pay by credit card, ensure it’s under the company name
• Take measures to ensure that payment by card is genuine and avoid ‘card present’ payment fraud Preventing payment fraud | Barclaycard Business
• Be vigilant about ‘card not present’ transactions How To Take Card Payments Over The Phone: The Full Guide (merchantsavvy.co.uk)
• Reduce the risk of chargebacks Eight ways to reduce chargebacks for your business | Stripe
• Do not accept pre-paid credit cards How to Mitigate and Prevent Prepaid Card Fraud: A Complete Guide (reloadly.com)

When a regular customer wants to hire another vehicle

• If you’re called by an unknown number, or the e-mail doesn’t look quite right, call the customer yourself and make sure the hire request is genuine
• Watch out for e-mail spoofing What is Email Spoofing? | Mimecast
• Complete all the usual DVLA licence and identity checks with the person arriving to collect a vehicle every time, and take their photo
• You may think you know the driver but things change. They may now have a conviction, they may have left the company you think they work for, or they may have been a bad actor all along

If a new company wants to hire a vehicle

• Never rely on a company letterhead as proof of identity
• Never give immediate credit
• Consider asking for business references from reliable sources
• Check the company is legitimate: How to check if a company is legitimate | Creditsafe
• Go to the Companies House website and check when the company was first registered, where their registered office is and what’s their business description
• Ask what the vehicle is going to be used for. If the stated use doesn’t correlate to their business description, and ask more questions
• If the registered address isn’t local, why are they coming to you to hire a vehicle?
• Find a phone number yourself for the firm that the caller / hirer claims to represent and ring the number to ask about the hire. Don’t just call a number the hirer gives you
• Do they have a website? Look it up and ask the hirer to tell you more about their business. What does the hirer know about the business the hirer claims to represent?
• When was the website domain name first registered? If recently, be cautious. Check by going to WHOIS Search, Domain Name, Website, and IP Tools - Who.is
• Do they have an e-mail address? Was it recently set up? Learning more about an e-mail address can be a valuable fraud detection tool Email Fraud Risk Score - Verify Identity | Emailage (lexisnexis.co.uk)

Make sure the weakest link isn’t close to home

• In some businesses, the weakest link is in the room
• If an insider accidentally or deliberately shares your hirer validation process with a bad actor, and weaknesses can be identified, instigating a fraud becomes that much easier
• Make sure you really know your staff https://www.xero.com/uk/accountant-bookkeeper-guides/fraud-prevention-tips/

To find out more about self-drive hire insurance, complying with insurers requirements, and avoiding vehicle rental fraud, talk to your usual Sentinel advisor, ring 01189 311 008 or e-mail info@sentinel-solutions.co.uk

Towergate, Towergate Insurance and Sentinel are trading names of Advisory Insurance Brokers Limited. Registered in England Company No. 4043759, Registered Office: 2 Minster Court, Mincing Lane, London, EC3R 7PD. Authorised and regulated by the Financial Conduct Authority.

About the author

Chris North FCII is a respected industry leader with over 40 years' experience, who has worked in the insurance industry in a variety of roles, accumulating a wealth of knowledge. He is currently Technical Manager for Towergate's motor division, providing expertise on all matters relating to motor fleet insurance, in particular haulage and self-drive hire fleets.