Cloned VINs and vehicle identity fraud

A cloned VIN is vehicle identity theft. A criminal copies the 17-character identification number of a legitimate car and puts it, with matching paperwork, on a stolen or salvage-branded car of the same kind, so the stolen car passes for the real one. The usual losers are the person who buys the clone, who typically loses the car and the purchase price when it is identified, and the owner of the "donor" car, who can be pulled into police and database problems that were never theirs.

This article is about the mechanism and the insurance consequences. It deliberately skips the pre-purchase checklist, which is covered in our Run a VIN check before you buy a used car guide, and spends its time on how the fraud works, who ends up holding the loss, and how title and theft coverage respond when a clone is found.

How a VIN is built and where it sits on the car

A vehicle identification number is not a serial number picked at random. Federal rule 49 CFR Part 565 sets the format. As published in the Code of Federal Regulations, the rule says:

• Every VIN has 17 characters, using digits and capital letters from a set that leaves out I, O and Q.
• Position 9 is a check digit, defined in the rule as a number or the letter X used to verify the accuracy of the transcription of the VIN.
• The first three characters identify the manufacturer and type of vehicle, and positions 4 through 8 describe vehicle attributes.
• No two vehicles built within a 60-year period beginning with the 1980 model year may share a VIN.
• The number must appear clearly and indelibly on a part not designed to be removed except for repair, or on a plate or label permanently attached to such a part.
• On passenger cars, light trucks and similar vehicles the VIN must be readable through the windshield from outside, at the driver's side windshield pillar.

Two consequences follow. First, a VIN is visible to anyone who walks past a parked car. Second, a made-up VIN is easy to catch, because the check digit has to fit a calculation based on the other characters, and a decoder can tell a plausible number from a random one. Criminals therefore copy a real VIN from a real car, which passes those tests.

VINs are also stamped or labeled elsewhere: the door jamb label, the engine or frame in many models, and the title and registration. A clone that swaps only the dashboard plate and the door label can leave other stamped locations showing the original number, which is one reason inspectors compare several places.

How criminals clone a VIN

Law enforcement and press accounts describe a recurring pattern. The details vary, but these are the usual steps.

1. Choose a donor. The criminal finds a legally owned car of the same make, model, year and often color, frequently one parked in a lot or at a dealership. The National Insurance Crime Bureau, in a 2007 announcement reported by Insurance Journal, described VIN cloning as using the VIN from a legally owned vehicle on a similar stolen one.
2. Copy the number. A photograph through the windshield is enough.
3. Make the labels. The thief produces a dashboard plate and a door-jamb label with the donor's VIN. Illinois investigators speaking to a Chicago TV station in November 2024 said they look for tell-tale signs such as the wrong font for a given maker and model year and creasing or bubbling in a sticker that a factory label would not show.
4. Remove the real identity. In an interview with a Florida TV station reported in March 2025, an Orange County sheriff's lieutenant described removing the windshield, swapping the VIN plate and refitting the glass so the work is harder to see.
5. Make the paperwork. A clone needs a title and a registration to match, and Illinois investigators said in 2024 that their Secretary of State's office had received a fraudulent title matching a replacement VIN. The Justice Department's NMVTIS program page describes a Florida-based ring in "Operation Roadrunner" that put VINs taken from other cars of the same make, model and year onto stolen vehicles, and says about 250 cloned vehicles were recovered across the country.
6. Sell it. Often to an individual, often privately.

Other variants exist. A thief who steals a car and swaps license plates with a similar car is doing something simpler. A seller who switches the VIN plates from a repaired flood or salvage car, or resells a branded car in a state with weaker title rules, is committing what the Triple-I describes as salvage fraud and "title washing". Another pattern, described by an Illinois detective, uses a stolen identity to buy a car with a loan, then sells the car on to an unsuspecting buyer; the lender later learns of the fraud and the title proves invalid.

Federal law treats tampering seriously. 18 U.S.C. 511 makes it a crime to knowingly remove, obliterate, tamper with or alter a motor vehicle identification number, with a penalty of up to five years in prison and a fine, and 18 U.S.C. 2321 makes it a crime, punishable by up to ten years, to buy, receive or possess a vehicle with intent to sell it while knowing its identification number has been altered. State laws add their own offenses.

How cloned cars are sold, exported and shipped

Private sales. In the Florida interview, the lieutenant said the large majority of re-VIN and clone vehicles his unit recovered came from individual sales, not large dealerships, and that they were sold through online marketplaces, by referral or by a roadside sign. A private seller has no brand to protect, a short window and cash.

Export. A stolen car may be given a clone identity to ship out of the country. U.S. Customs rules for exporting a used vehicle, at 19 CFR 192.2, require the exporter to present the vehicle and documentation that includes the VIN and the original title at least 72 hours before export by vessel, plus a written consent from any lienholder or lessor. That documentation requirement is one place a mismatched or forged title can be caught, which is why criminals work to make the paperwork look real. For more on export, chop shops and how stolen cars are routed, see Where stolen cars go: export, chop shops and VIN cloning.

What happens when the buyer's car is seized

The sequence is consistent across cases reported in local news.

• A Washington woman bought a 2019 Toyota 4Runner on Facebook Marketplace in December 2021 for what she described as a retirement car. Its title, VIN and a vehicle history report all matched. Almost three years later, a licensing agent sent her to a Washington State Patrol VIN inspection when she tried to renew her registration. According to WPXI's June 2024 report, the inspection found the SUV was stolen from a dealership in Vancouver, Washington, and carried a VIN copied from a similar vehicle near Portland. The vehicle had to be seized, she lost about $40,000, and she filed an insurance claim; after some back and forth her insurer covered the loss of the car.
• A Florida woman paid $21,000 in cash for a Lexus bought through a marketplace listing. The DMV registered it, and months later an investigator told her someone in Georgia had tried to register a car with the same VIN. Her car had been reported stolen from a rental company in 2023. WKMG's account, published in March 2025, reports that she lost the car and the money.
• In Illinois, a Joliet police detective told FOX 32 Chicago in November 2024 that when a bank discovers a car was bought with a loan taken out in a stolen identity, the title is not valid and the final buyer loses the vehicle.

The common thread is that the identity check the buyer relied on, the DMV registration or the history report, did not detect the clone. The pass at the DMV counter showed only that the paperwork was coherent.

Who bears the loss

Property law supplies the starting point. Under the Uniform Commercial Code in the form most states have adopted, a purchaser acquires the title the seller had or had power to transfer. The general rule is that a thief has no title, so there is nothing to pass on, however honest the buyer is. A seller who sells goods also warrants, under UCC section 2-312, that the title conveyed is good and its transfer rightful. That gives a buyer a legal claim against the seller. In practice the seller is often untraceable, was using a false name or has no money. State rules differ in important details, and a licensed attorney is the right person for a particular case.

A worked example

Say a buyer pays $19,000 in cash for a used pickup from a private seller and registers it. Fourteen months later a state inspector identifies it as a clone. The truck was stolen from a dealer, whose insurer paid the dealer $22,000, and the truck's true identity belongs to another vehicle with the same VIN.

These figures are invented for illustration, not market data.

How insurance responds

The original theft claim. When a car is stolen and the owner's insurer pays, the insurer usually takes over the owner's rights to the vehicle, including the right to recover it. That is why it is the insurer, not the original owner, that often reclaims a recovered clone. See subrogation explained: how your insurer recovers your deductible for the general mechanism.

The buyer's own policy. comprehensive coverage pays for direct and accidental physical loss, such as theft, fire and vandalism. A car taken by authorities because its title was defective is not a classic theft or accident. It is a failure of ownership. Some insurers deny, some pay for good will or after negotiation, as the Washington case shows. Ask your insurer in writing how it treats a title defect before you need the answer. Our guide to what to do if your car is stolen covers the ordinary theft case.

The loan. If the car is financed, the lender must still be repaid. Gap insurance pays the difference between a car's value and the loan after a covered total loss, and a seizure may not qualify. Check the wording.

The donor's side. The legitimate owner may see a registration or toll notice, a ticket, a flagged history report or an insurer asking about a second car with the same VIN. Experian Automotive's AutoCheck and the NICB said in 2007 that a confirmed clone would be flagged with a "cloned" designation on the report and that the company would work with the donor car's owner to remove false history. That announcement is old, so ask any vehicle history provider how it handles disputes today. Contact the police, your state motor vehicle agency, and your insurer, and keep copies of everything.

The insurer finds a duplicate. Insurers can notice two active policies, claims or inspections for the same VIN through claim databases such as the one in ISO ClaimSearch and how fraud analytics flag claims. When that happens the claim is typically referred for investigation. If you are an innocent buyer, cooperate fully, hand over the purchase paperwork and messages with the seller, and say plainly that you did not know. Insurance fraud statutes such as those of Florida and New York require a knowing, intentional deception, and that is the difference between a victim and a participant.

How clones get detected

Title checks at the state level. The Anti Car Theft Act and its regulations require each state to run an instant title verification check through the National Motor Vehicle Title Information System (NMVTIS) before issuing a title to a vehicle brought into the state, and states were required to be fully compliant by January 1, 2010, according to the NMVTIS program overview. The same page says insurers and junk and salvage yards must report vehicles deemed junk, salvage or total loss at least monthly, as they have since March 31, 2009. NMVTIS also covers theft data in some cases. Its own materials say that Arizona, Florida and Virginia identified cloned vehicles by working together before issuing new titles.

Consumer reports. Buyers can search NMVTIS data at vehiclehistory.gov through approved providers for brands, odometer readings and total-loss records. These show title and brand history. They do not inspect the car, and a clone can arrive with a perfectly clean history because the history belongs to the donor. In the Washington case above, the buyer said the history report matched.

Concurrent registrations. The NICB's 2007 announcement said history reports can reveal concurrent registrations, a signal of cloning. The same VIN registered in two states at once is the classic pattern.

Physical inspection. In the Washington case, a state patrol VIN inspection caught the clone. Police auto theft units and some state agencies will compare VIN locations on request. Florida's lieutenant said buyers can ask his unit to look at a car before a purchase. The red flags investigators cite include a VIN plate that has shifted, misspelled words on the door label and a seller whose name does not match the title.

If you think you bought a clone

1. Stop driving it if you can, and do not sell it. Selling it to someone else makes you part of the chain.
2. Do not confront the seller alone. Preserve their messages, phone number, listing and any payment record.
3. Photograph every VIN location and the title, registration, bill of sale and the history report you relied on.
4. Call local police or your state's auto theft unit and tell them what you found.
5. Notify your insurer in writing and ask how it treats a title defect.
6. Contact the lender if the car is financed.
7. Consult a licensed attorney about recovering the price from the seller.
8. Report it to the NICB, which investigates cloned-VIN cases with law enforcement.

Common questions

Can a clone be detected by decoding the VIN?

Not reliably. A cloned VIN is a real VIN, so it decodes correctly and the check digit works. The mismatch is between the number and the car: the decoded make, model and engine may not match what is in front of you, or the number may differ from the other stamped locations.

Is my vehicle history report enough protection?

No report guarantees the car is what it says. A clone can carry the donor's clean history. A report is one check among several; compare the VIN in multiple places and look at the seller's name and the title.

Does buying through a dealer eliminate the risk?

It lowers the risk but the Florida lieutenant said most of the clones his unit sees come from individual sales. A dealer also carries legal duties as a seller, which can help you recover if the title turns out to be bad, but that varies by state.

Will my premiums rise if my VIN was cloned?

The cloning itself is not your driving record. Problems arise only when a duplicate vehicle's tickets, tolls or claims attach to your VIN by mistake. Ask your insurer and the agency involved to correct the records.

Is VIN cloning the same as a chop shop?

No. A chop shop dismantles cars for parts. Cloning keeps the car whole and changes its identity so it can be sold or driven.

Key takeaways

• A cloned VIN is a real VIN copied from a similar legitimate car, so it passes decoder and check-digit tests that would catch an invented number.
• The buyer usually loses the car when it is identified, because a thief has no title to pass. A claim against the seller exists, but sellers are often untraceable.
• Whether the buyer's own insurer pays depends on policy wording and the insurer. The original theft insurer, having paid, typically reclaims the car.
• State title checks against NMVTIS, concurrent-registration flags and physical inspections catch clones, but history reports alone can miss them.
• If you suspect a clone, preserve evidence, contact law enforcement and get legal advice before you sell, repair or hand over anything.