NCIC Specific File Requirements: Stolen Vehicles and License Plates 3 — Questions and Answers
Question 1: When entering a stolen vehicle into NCIC, what should an agency do if the VIN has been altered or removed from the vehicle?
- The vehicle cannot be entered into NCIC without a VIN
- Document the known partial VIN or vehicle identification information and enter the most complete record possible, noting VIN alteration in appropriate fields (Correct answer)
- Wait for the FBI to recover the VIN before entering
- Only enter a vehicle theft report into the state system — NCIC requires a complete VIN
Correct answer: Document the known partial VIN or vehicle identification information and enter the most complete record possible, noting VIN alteration in appropriate fields
When a VIN is altered or removed, the agency should enter as much identifying information as possible, noting the VIN alteration, to create a useful record even without a complete, intact VIN.
While the VIN is the primary identifier for NCIC stolen vehicle records, the absence of a complete or intact VIN does not prevent entry. When a VIN has been removed, defaced, or altered — a federal crime under 18 U.S.C. § 511 — the agency should enter all available identifying information: partial VIN, manufacturer's label information, documented VIN from the theft report or insurance records, and complete physical description. The alteration should be noted in the appropriate NCIC fields. Even an incomplete record may generate useful leads, and documenting the VIN alteration in NCIC alerts any officer who subsequently encounters the vehicle that the VIN has been tampered with — itself probable cause for further investigation.
Question 2: What does NCIC policy require when a vehicle is recovered but is considered a total loss before it is cancelled from the Stolen Vehicle file?
- The record must be cancelled upon recovery regardless of condition
- The record must be cancelled immediately upon confirmed recovery, even if the vehicle is a total loss and will be disposed of (Correct answer)
- The record may remain active until insurance proceedings are concluded
- Total loss vehicles are automatically cancelled by the FBI within 90 days
Correct answer: The record must be cancelled immediately upon confirmed recovery, even if the vehicle is a total loss and will be disposed of
Regardless of the recovered vehicle's condition, the NCIC Stolen Vehicle record must be cancelled immediately upon confirmed recovery.
NCIC policy is unambiguous: a stolen vehicle record must be cancelled as soon as the vehicle is confirmed recovered, regardless of the vehicle's condition or the status of any insurance claim. Whether the vehicle is recovered intact, stripped, or as a burned total loss, the NCIC record must be cancelled. Allowing a total loss vehicle to remain in NCIC while insurance proceedings are ongoing creates stale data — and if someone is found driving a vehicle whose VIN or plates somehow resurface, an officer could act on an invalid NCIC entry. The insurance proceeding is a civil matter that has no bearing on the criminal justice purpose of the NCIC record.
Question 3: Under what circumstances would an officer query both the Stolen Vehicle file and the Stolen License Plate file separately during a traffic stop?
- This is never necessary — a single NCIC query covers all stolen files simultaneously
- When the officer wants to check whether the plates are legitimately associated with the vehicle or may have been stolen from another vehicle (Correct answer)
- Only when directed by their sergeant to run a comprehensive check
- Only when the vehicle is a commercial truck or specialty vehicle
Correct answer: When the officer wants to check whether the plates are legitimately associated with the vehicle or may have been stolen from another vehicle
Querying both files separately allows an officer to determine not only whether the vehicle itself is stolen, but also whether the license plates on the vehicle may have been stolen from a different vehicle — a tactic used to disguise stolen vehicles.
During a traffic stop, a thorough NCIC check should include queries of both the Stolen Vehicle file (using the VIN) and the Stolen License Plate file (using the plates displayed on the vehicle). This dual-query approach catches a common vehicle theft tactic: stealing a vehicle, then placing legitimately obtained or stolen plates from a similar vehicle on it to defeat automated plate reader detection. The vehicle may not be in NCIC as stolen (if the theft hasn't been reported or the stolen entry relates to a different VIN), but the plates may be in NCIC as stolen from another vehicle. Comprehensive NCIC queries are a best practice for thoroughness and officer safety.
Question 4: What is the significance of a 'VIN cloning' situation for NCIC record management?
- VIN cloning occurs when a manufacturer reuses a VIN — it has no law enforcement significance
- VIN cloning is when a stolen vehicle is given the VIN of a legitimately titled vehicle, creating potential false positives or false negatives in NCIC queries (Correct answer)
- VIN cloning is when a VIN is entered twice in NCIC due to an operator error
- VIN cloning only affects imported vehicles and is handled by Customs and Border Protection
Correct answer: VIN cloning is when a stolen vehicle is given the VIN of a legitimately titled vehicle, creating potential false positives or false negatives in NCIC queries
VIN cloning involves applying the VIN of a legitimately titled vehicle to a stolen vehicle, creating situations where an NCIC query may not return a stolen hit even though the vehicle is stolen.
VIN cloning is a sophisticated vehicle theft scheme in which thieves steal a vehicle and then obtain the VIN of a legally owned, legitimately titled identical vehicle (same make, model, year, and color) and apply that VIN to the stolen vehicle using counterfeit VIN plates. The cloned vehicle may not show up in NCIC as stolen because the VIN being queried belongs to a vehicle that is not stolen. Officers should be alert to VIN cloning indicators: VIN plates that appear tampered with, documentation that doesn't match the vehicle, or situations where two vehicles share the same VIN (detectable if both are queried in NCIC at the same time or if a state title check shows the legitimate vehicle is a different location). NCIC alone cannot always detect VIN cloning.
Question 5: When a law enforcement agency seizes a vehicle suspected of being stolen but cannot confirm the VIN due to damage, what investigative resource can assist in recovering the VIN?
- The vehicle owner's insurance records only
- The National Insurance Crime Bureau (NICB), manufacturer confidential VIN locations, and forensic VIN recovery techniques (Correct answer)
- Contacting the selling dealership directly
- Running the vehicle's color and year through NCIC to find matching records
Correct answer: The National Insurance Crime Bureau (NICB), manufacturer confidential VIN locations, and forensic VIN recovery techniques
The NICB, manufacturer-specified confidential VIN locations, and forensic techniques can help recover or confirm a VIN when the primary VIN plate has been removed or damaged.
When a vehicle's primary VIN plate has been removed or damaged, investigators have several resources to attempt VIN recovery. The National Insurance Crime Bureau (NICB) maintains vehicle ownership and title records that can assist in identifying a specific vehicle. Vehicle manufacturers place confidential secondary VINs in undisclosed locations on vehicles — these locations are known to law enforcement through the NICB and manufacturer liaison programs and can be checked to reveal the true VIN. Forensic techniques including chemical etching restoration can sometimes recover VINs that have been physically obliterated from metal. These investigative resources allow law enforcement to establish the vehicle's true identity even when the primary VIN has been compromised.
Question 6: How should an agency handle the NCIC Stolen Vehicle record if the victim decides not to prosecute the theft case after the vehicle has already been entered?
- The record stays active — victim's decision not to prosecute does not affect the NCIC entry
- The record should be cancelled because the victim's refusal to cooperate eliminates the ability to pursue the matter as a criminal case and the basis for the entry is effectively gone (Correct answer)
- The record should be modified to indicate victim non-cooperation
- The FBI must be notified and it decides whether the record stays
Correct answer: The record should be cancelled because the victim's refusal to cooperate eliminates the ability to pursue the matter as a criminal case and the basis for the entry is effectively gone
If the victim refuses to cooperate and the case cannot proceed as a theft, the legal basis for the NCIC entry may no longer be present, and the record should typically be cancelled.
While a victim's decision not to prosecute does not automatically eliminate the legal basis for an NCIC entry (a theft is a theft regardless of prosecution decisions in many jurisdictions), if the victim's refusal to cooperate results in a determination by the agency that a theft did not actually occur — for example, the owner now admits the vehicle was not stolen but was borrowed without explicit permission — then the factual basis for the NCIC entry has been undermined and the record should be cancelled. Each situation must be evaluated on its merits. If the vehicle was genuinely stolen regardless of prosecution choices, the NCIC record may be maintained, but if the basis for the theft determination is compromised, cancellation is appropriate to avoid maintaining a record that may lack validity.
NCIC Specific File Requirements: Stolen Vehicles and License Plates 3
When entering a stolen vehicle into NCIC, what should an agency do if the VIN has been altered or removed from the vehicle?