It is Friday afternoon and a walk-in wants the Charger for the weekend. Nice guy, in a hurry, pays with a card that is not quite his name. You are slammed, and the license photo looks close enough. You hand over the keys. Monday the car is gone, the card was stolen, the deposit charge reverses as a chargeback, and the driver on the agreement does not exist. You did not get robbed at gunpoint. You handed the car to a fraud and signed the paperwork yourself.
Here is the short version so you can close the hole this week. Fraud is not something you catch after the car leaves. You stop it at the counter, before the keys move, with a gate every booking has to pass: a real identity checked against a real source, a card that matches the person standing there, an age rule you enforce, a risk flag on the bookings that smell wrong, and nothing released until all of it clears. None of this slows a good renter by more than a minute; it just sends the bad ones elsewhere.
Key Takeaways
- Verify the data, not just the plastic. A license can be a convincing fake. Check the number and name against state DMV records through the AAMVA DLDV service.
- Match the card to the person. Require CVC and AVS on every booking. A stolen card often fails the address check, and Stripe can flag a payment on that signal.
- The risky bookings have a pattern. A rush request on your most expensive car, a far-away billing address, and a mismatched card name are the flags that deserve a human look before anyone gets keys.
Table of contents
- What a fraudulent rental actually costs you
- The renter-verification system
- Stage 1: Collect the right identity and payment data
- Stage 2: Verify the license and the person
- Stage 3: Set age and eligibility rules you enforce
- Stage 4: Verify the card matches the renter
- Stage 5: Score the booking and flag for review
- Stage 6: The key-release gate and the record
- Three operators, three versions of the gate
- The compliance you cannot skip
- Steal these: the scripts and the checklist
- Common objections, answered
- Frequently asked questions
What a fraudulent rental actually costs you
A fraud rental is not one loss, it is a stack of them. You lose the car, sometimes for weeks. You lose the deposit, because the card was never good. You lose the chargeback fight, because a stolen-card transaction is almost impossible to win. One bad weekend wipes out a month of margin.
The scale is not small. In 2024 the FTC logged about 1.1 million identity-theft reports, and credit-card fraud was the single largest category (FTC Consumer Sentinel Data Book 2024). Global payment-card fraud losses hit $33.41 billion in 2024, with US cardholders absorbing close to 42% of the total (Nilson Report, via Chargebacks911). The stolen identity and the stolen card are the two tools that turn a normal-looking booking into a theft.
Car rental is a soft target: the payoff is an asset worth tens of thousands of dollars, handed over on a photo and a card swipe, and it runs at organized scale. In one Eastern District of Missouri case, eight people pleaded guilty to a nationwide scheme that used stolen identities to rent vehicles and keep them (US Department of Justice). If you came up as a Turo or Getaround host, the platform ran a verification layer you never saw: Turo listed about 170,000 active hosts and 360,000 vehicles at the end of 2023 (Turo S-1/A). Independent, that layer is now yours.
US identity-theft reports by type in 2024. Credit-card fraud is the biggest category by a wide margin, and it is the exact tool used to book a car on someone else’s money. Source: FTC Consumer Sentinel Network Data Book 2024.
The renter-verification system
The whole system is one idea: nothing leaves the lot until the booking passes a gate of six checkpoints that every booking, online or walk-in, goes through. The point is to make the good ones glide through and the bad ones hit a wall.
- Collect the identity and payment data you need, cleanly, at booking.
- Verify the license and the person behind it.
- Enforce your age and eligibility rules automatically.
- Verify the card actually belongs to the person holding it.
- Score the booking and route anything suspicious to a human.
- Release the keys only when every check clears, and keep the record.
Each stage has a way it breaks, and the breakage is where the loss lives.
Stage 1: Collect the right identity and payment data
You cannot verify what you did not capture. Your booking form needs the legal name exactly as printed on the license, date of birth, license number and issuing state, a mobile number, an email, and the card. Capture a photo of the front and back of the license and a live selfie for any booking over a value threshold you set. It is also the data that wins a chargeback dispute in front of a bank. In GoHighLevel, the booking form writes it all onto the contact for every later step to read.
Stage 2: Verify the license and the person
A modern fake license passes the eyeball test: right hologram feel, right layout, real-looking photo. What it usually cannot do is survive a check against the state’s own records. The AAMVA Driver License Data Verification service lets an approved business confirm that a license number, name, and date of birth match what the issuing DMV has on file. Most independents reach it through a vendor, and coverage is not every state.
Verifying the document is only half the job. You also have to confirm the person is the one on the license: at the counter, face against photo and name against card; for a remote booking, a liveness selfie matched to the license photo. The document check tells you the ID is real; the face match tells you it belongs to whoever is holding the keys.
Stage 3: Set age and eligibility rules you enforce
Eligibility is the quiet half of fraud prevention, because a renter who should never have qualified is one your insurer may refuse to cover after a claim. Write the rules down and let the system enforce them: a minimum age (many lots set 21, some set 25 for premium or exotic vehicles), a young-driver surcharge for the 21-to-24 band, a minimum license-held period, and rules for out-of-state and international licenses. The funnel reads age from Stage 1 and applies the surcharge or blocks the booking, so a 23-year-old booking the Corvette is stopped by the form, not waved through because the lobby is full.
Stage 4: Verify the card matches the renter
A stolen card is the engine of most rental fraud, because it funds a deposit that looks real until it reverses. The cheapest defense is built into your processor: require the card security code (CVC) and the Address Verification Service (AVS) check on every transaction. The issuer confirms the code and compares the billing address against its records during authorization (Stripe). A thief using a card number they bought online rarely has the matching billing address. Then place a real deposit hold on that same verified card, not a charge, and keep it live through the rental (the full mechanics are their own playbook). The card has to match the person, and the hold has to be alive when the car comes back.
Stage 5: Score the booking and flag for review
You cannot inspect every booking, so score each one and send only the suspicious ones to a human. Fraud has a shape, and the signals are in the review checklist below: a rush booking on your most expensive car, a far-away billing address, a name that does not match the card, an unverifiable license. None alone proves fraud. Three stacked on your $90,000 car is a booking a person should look at.
Build it as a simple risk flag. When a booking trips two or more signals, the system tags it “review,” pauses the confirmation, and alerts you. The out-of-town renter gets a quick extra check; the ring probing your lot hits a human instead of an instant yes. It is where synthetic identities get caught, fabricated people stitched from real and fake data that one estimate pegged at about $2.94 billion in US lending losses in 2025 (Mitek and Datos Insights, 2026). Weight the flags by vehicle value: a $45-a-day sedan and a $900-a-day exotic should not carry the same threshold.
Stage 6: The key-release gate and the record
Every stage before this feeds one decision: do the keys move. Keys release only when identity is verified, the renter matches the license, eligibility passes, the card cleared CVC and AVS with a live deposit hold, and any review flag is cleared by a human. If one is open, the car stays in the lot. This is also when you lock in your evidence: the signed digital rental agreement and timestamped condition photos out and back, stored against the reservation. That record defends your deposit, and weak documentation is a leading reason rental insurance claims get denied.
Three operators, three versions of the gate
The six checkpoints are the same at every size. How much you automate, and how tight you set the gate, changes with your fleet.
The solo host, 3 to 8 cars. You are the gate. Use a phone-based license and selfie vendor, require CVC and AVS, and set one rule: no keys over a set value until the license verifies and the card name matches. The risk is skipping the check on the booking that feels too easy.
The 20-car lot with staff. The gate has to work when you are not there. Automate license verification at booking, encode your age rules into the funnel, and block staff from confirming a flagged booking without a logged manager override. A flag is a stop, not a suggestion.
The exotic or luxury operator. Your cars are the prize, so you are the target. Run the tight gate on everything, and add a second ID and a short verification call before pickup on your top cars. A renter booking a $200,000 car will not blink at five minutes of verification. A thief will go rent somewhere that does not ask.
The compliance you cannot skip
Screening touches a few laws, and getting them wrong trades a fraud loss for a legal one. This is general information, not legal advice, so run your exact process past a lawyer in your states.
If you pull a background check, credit report, or driving record through a third-party screening company to decide whether to rent, that report is almost certainly a consumer report and the federal Fair Credit Reporting Act applies. You need a permissible purpose, usually the renter’s written authorization, and if you decline someone based on that report you owe them an adverse-action notice naming the company that supplied it (FTC business guidance). A straight AAMVA license verification is lighter-touch, but the moment you score someone’s history, treat FCRA as live.
Three more: never deny based on a protected class, so your rules stay about the booking and apply the same way to everyone; tokenize card data and never store raw numbers or the CVC (PCI-DSS); and if any step texts a renter, the TCPA and 10DLC rules apply.
Steal these: the scripts and the checklist
Paste these in and adapt the bracketed parts. They carry the system without making a good renter feel like a suspect.
Booking-form consent line (at the identity fields):
To protect our fleet and your deposit, we verify every renter’s license and payment before pickup. Please enter your name exactly as it appears on your license. By continuing you authorize [Your Company] to verify your license and payment method.
Verification request text (right after an online booking):
Hi [First name], thanks for booking the [Vehicle] with [Your Company]. One step to confirm your reservation: tap this secure link to photograph your license and take a quick selfie. About 60 seconds. [link]
The second-step text (for a flagged booking, no accusation):
Hi [First name], we’re finishing your reservation for [date]. For this vehicle we do one extra verification step. Reply with a second photo ID, or call us at [number], and we’ll get you on the road.
The manual-review checklist (what a human looks at on a flagged booking):
- Does the license verify against DMV data, or come back unverifiable?
- Does the name on the card match the name on the license?
- Did the card pass CVC and AVS, or did the address fail?
- Is the billing address near the pickup, or far away?
- Is the phone a real mobile that received the verification text?
- Is this a rush booking on a high-value car outside normal hours?
Two or more red answers on a premium car: ask for a second ID or decline, and keep the record either way.
Match the level to the car. Here is how the methods stack up:
Verification methods compared
| Plan | Eyeball check | CVC + AVS recommended | License + selfie recommended | Full screening |
|---|---|---|---|---|
| Price | Free | Built in | Per check | Higher |
| Feature 1 | No | Partial | Yes | Yes |
| Feature 2 | No | Yes | No | Yes |
| Feature 3 | No | No | Yes | Yes |
| Feature 4 | Any walk-in | Every booking | Premium + remote | Exotic / luxury |
Rows: verifies the license, verifies the card, matches the person, best fit.
Common objections, answered
“Won’t all this verification scare off good renters?” No, if you build it right. A good renter uploads a license photo and a selfie in under a minute and never sees the rest. The friction only lands on the bookings that trip the flags, and the booking you lose to a verification step is almost always one you were going to lose a car to.
“I’ve rented for years on a handshake and been fine.” You have been fine until the one weekend you are not, and that weekend costs a car. The gate is standing on the quiet weekends so it is already there the weekend someone tests it.
“This sounds like enterprise software I can’t afford.” The core is not. CVC and AVS are already in your processor at no extra cost, and a license-and-selfie check is a few dollars, far less than a deductible. The automation that ties it together runs in the same GoHighLevel setup you use for reservations and reminders.
Frequently asked questions
How do I verify a driver's license is real?
Check the license data (number, name, date of birth) against the issuing state's DMV records through the AAMVA Driver License Data Verification service, usually through a verification vendor. A hologram proves little, because modern fakes replicate it, and a result of 'unverifiable' should be treated as a stop.
What is the cheapest thing I can do to cut rental fraud?
Turn on CVC and Address Verification Service (AVS) checks in your payment processor and act on the results. They are free and built in, and a stolen card frequently fails the address check. Per Stripe, a payment can still authorize when AVS fails, so route a failure on a high-value booking to manual review.
Can I refuse to rent to someone I think is a fraud risk?
You can decline a booking, but your reasons must be about the booking, applied the same way to everyone, and never based on a protected class. If you declined based on a third-party background or credit report, the Fair Credit Reporting Act requires an adverse-action notice; see the FTC's guidance. This is general information, not legal advice.
Do I need a background check on every renter?
No. A full background or credit report triggers FCRA obligations and is overkill for an economy rental, so reserve it for high-value or long-term rentals. For most bookings, a verified license, a matched selfie, and a card that passes CVC and AVS with a live deposit hold is the right level.
How does this connect to winning chargebacks later?
The same verification data is your evidence. A matched license, a card that passed CVC and AVS, a signed agreement, and timestamped condition photos are what a bank wants in a dispute. Screening at the front door and defending the chargeback at the back door are two ends of one record.
Go back to the Friday walk-in. You run his license against the DMV, the card fails the address check, the name does not match, and your system flags the booking before any key leaves the drawer. You decline, release the hold, and the Charger is still in your lot Monday morning, earning, instead of in an impound lot. That is the whole job of the gate: make the car boring to steal, so the people who want to steal it go somewhere easier.