Luxury Car Rental Fraud: Vetting Renters Before Handover

For a premium rental company, the costliest risk is not a scuffed wheel: it is a car handed to the wrong person. A false name, a third party's card, a driver without a valid licence: most of these frauds can be stopped before the keys change hands, provided you always run the same sequence of checks.

This guide sets out that sequence, then what the GDPR and some national rules allow you to verify and keep. It is not legal advice: rules differ between countries, so have your procedures and privacy notice reviewed locally.

Six checks, always in the same order

Identity: does the document match the person standing in front of you and the name on the booking? Original document, photo, expiry date.
Driving licence: valid, right category, in the name of the declared driver and of every additional driver. Rental companies do not always have access to official licence registers: in France, for example, Article L225-5 of the Highway Code lists who may receive information on the existence and validity of a licence, and rental companies are not on the list. The check is then made on the document itself. In Great Britain, the DVLA lets drivers "create a licence ‘check code’ to share your driving record with someone, for example a car hire company"; ask for it at booking, since "The check code will be valid for 21 days."
Payment card: in the name of the renter or main driver, not of an absent third party. The deposit hold is authenticated by the cardholder with their bank through 3-D Secure.
Rental agreement: signed before pick-up, including deposit, deduction and cancellation terms. Stripe recommends having customers accept the full text of your terms, not just a link, so that it carries weight in a dispute.
Condition report: dated photos, mileage, fuel, signature. It records the car's state at the minute you hand it over. See our guide to the digital condition report.
Security deposit: authorised before key handover, not promised for later. Mechanisms and validity periods are covered in our guide to the online security deposit.

The warning signs

No single sign proves fraud; it is their accumulation that should trigger an extra check. Stripe lists, among the indicators of a suspicious payment, an order much larger than usual, goods with a high resale value, a request for urgency, several declined attempts, several cards used from the same IP address, or a card country that does not match the other details. Applied to premium rental:

a first-time, last-minute booking on the most expensive car in the fleet;
several cards declined for the deposit, or a card in someone else's name;
a driver different from the person who booked, announced at the last minute;
pressure to shorten the condition report or to deliver the car somewhere other than agreed;
contact details that do not match across the booking, the ID and the card.

When in doubt, call the customer and ask for an additional document. If you refuse a rental, record an objective reason (declined card, invalid document, inconsistencies) rather than a gut feeling: in France, for instance, the Consumer Code prohibits refusing a service to a consumer without a legitimate reason (Article L121-11).

What the law lets you check and keep

The examples below come from EU law and from France, Germany, Italy and Spain; different rules apply in the United Kingdom and Ireland. The GDPR does not stop you from vetting a customer; it governs what you keep. Personal data must be limited to what is necessary (data minimisation) and kept no longer than the purpose requires (Article 5). Recital 47 recognises that processing strictly necessary for preventing fraud is a legitimate interest of the controller.

Seeing is not copying. Checking a document and recording its number and expiry date often meets the need. Archiving full scans multiplies the data you hold, and the damage in a breach: every stored copy needs a justification. In Germany, the Personalausweisgesetz (section 20) allows a national ID card to be photocopied only by its holder or with the holder's consent, with the copy clearly and permanently marked as a copy.
National reporting duties. Some countries require rental companies to pass renter data to the authorities. In Italy, Article 17 of Decree-Law 113/2018 requires the identification data from the renter's ID to be sent to the police database when the contract is signed, and in any case well before handover. In Spain, Royal Decree 933/2021 requires a register of renters, drivers and payment details, communicated within 24 hours and kept for three years.
Automated decisions. If you keep a list of customers you no longer rent to, base entries on objective, predefined grounds and have a person take the decision: the GDPR gives individuals the right not to be subject to a decision based solely on automated processing (Article 22).
Biometrics. Some services compare an ID document with a selfie; Stripe Identity, for example, matches the document with a photo of its holder. Biometric data processed to uniquely identify a person is a special category (Article 9): processing it is prohibited unless an exception applies, such as explicit consent.

What Corsiva OS does, and what it does not

Corsiva OS is built by a team that runs its own premium fleet. It does not replace your team's judgement on documents; it makes sure no step is skipped:

Key handover blocked until everything is green: rental paid, deposit authorised by card hold, documents checked (ID and licence), agreement signed.
Documents received by link: pre-payment and licence go through a link sent to the customer, with no re-keying.
Digital vault: ID documents, licences, agreements and deposits are archived and timestamped in one place, rather than scattered across messaging apps.
Stripe card hold with 3-D Secure, released on return or partially captured if there is damage; Corsiva stores no card data.
Mobile condition report: mileage and fuel readings, guided photos, customer signature, signed PDF archived.
Built-in GDPR tools: full export of your data, correction and deletion of records, permanent account deletion, two-factor authentication; servers and database in Europe.

Document checks are carried out by your team: the OS keeps a record and blocks the pick-up until they are validated. Condition reports and e-signature are included from the Lite plan, the deposit from Business; details are on the pricing page. Our guide to the car rental agreement covers the clauses that matter, our guide to charging damage and the excess to the renter covers what happens at return, and insurers will ask about these checks: see our guide to car rental fleet insurance. The interface is available in French, English, German, Spanish and Italian.

Frequently asked questions

Can a rental company keep a copy of the customer's ID?

The GDPR requires every piece of data you keep to be necessary, and some countries add their own rules: in Germany, a national ID card may only be copied with the holder's consent. Checking the document and recording its number and expiry often suffices; if you keep a copy, justify it, secure it and set a retention period.

Can I check a driving licence with the authorities?

It depends on the country. In France, for instance, Article L225-5 of the Highway Code lists who may receive licence information, and rental companies are not included. In Great Britain, the DVLA lets drivers create a check code to share their driving record, for example with a car hire company; the code is valid for 21 days. Where you have no access, the check is made on the document: validity, category, driver's name.

Must the payment card be in the driver's name?

It is up to you to require it in your terms and conditions. A card in the name of an absent third party is a warning sign, and with 3-D Secure it is the cardholder who authenticates the hold.

Can I keep a list of high-risk customers?

Only within strict limits: objective, predefined grounds, a human decision, limited retention and information for the people concerned. The GDPR gives individuals the right not to be subject to a decision based solely on automated processing.

Do I have to report renters to the police?

In some countries, yes. Italy requires renter ID data to be sent to the police database before handover, and Spain requires a register communicated within 24 hours. Check the rules where you operate.

Does Corsiva OS verify customer identity automatically?

Document checks are done by your team, not by an algorithm. The OS collects documents by link, keeps them timestamped in the rental file, and blocks key handover until documents, agreement, payment and deposit are validated.

Luxury Car Rental Fraud: Vetting Renters Before Handing Over the Keys