NHTSA keeps over 48000 World Manufacturer Identifier codes in the vPIC system, and the database handles millions of VIN decoder queries a year from dealers, lenders, insurers, title clerks, and law enforcement. The 17-character format goes back to 1981 under 49 CFR Part 565, and every character encodes something about the vehicle, assembly country, manufacturer, engine, body, restraints, model year, plant, and production sequence. There is a mathematical check built into the ninth position that breaks when any other character gets changed, and that check is what catches fabricated VINs if anyone runs it. The NICB put 2025 national vehicle thefts at 659880, the lowest in decades, and 23 percent below 2024. The theft rate in the first half of the year came in at about 97 per 100000 nationally. Those numbers look good. The cloning numbers do not, and the NICB has been saying that publicly for a while now. VIN cloning operations copy VINs off legitimate vehicles and attach them to stolen ones, and a cloned VIN goes through a database check without any trouble because the number belongs to a real vehicle that is still out there with its owner. Nobody catches it until someone actually looks at the characters on the plate and checks whether the VIN decodes to the vehicle that is physically sitting there, and in most private sales and a lot of dealer transactions, that step never happens.
NHTSA requires a check digit in position nine calculated from the other sixteen characters using a weighted formula. Cloning operations that change a few characters to shift the model year or the plant code so the number won't duplicate an active registration in the same state usually don't recalculate the ninth position, and the digit comes out wrong. The vPIC decoder will flag it on any VIN that gets submitted, but at a DMV title counter or in a parking lot during a private sale, nobody is running the VIN through vPIC. The metro areas leading the theft volume nationally, California's major metros, D.C., parts of the southeast, are the same areas where cloned vehicles enter the resale pipeline, and the vehicles tend to move across state lines before the first sale because most state licensing agencies do not check for duplicate ownership when an out of state title gets surrendered. One manufacturer shipped a batch of 2024 and 2025 vehicles with the wrong check digit from the factory because of a coding mistake in the assembly software. The dealer management systems at the receiving stores would not process the VINs, and when the vehicles went to financing, the lender platforms kicked them back, too. Some state DMV offices could not get the registrations through at all, and it took NHTSA issuing documentation on those specific numbers before the title systems would accept them. Nobody had realized how many points in the transaction chain were quietly checking position nine until a factory error broke it at scale, and outside of a known exception like that one, a failed check digit on any vehicle means somebody assembled the number from parts of other VINs.
The VIN's first three characters cover country of assembly, manufacturer, and vehicle type. The next five carry model, body, engine, and restraint codes, and those codes are manufacturer specific so what sits in position five on one production line means something different on another, but the factory put them there when the vehicle was built, and a VIN decoder run through the NHTSA system will return what they say. When what comes back does not match the vehicle that is actually there, when the VDS says four cylinder and the engine has six, or the body code says sedan, and you are looking at a pickup, the VIN came from a different vehicle. The vehicle history report and the NMVTIS record for that number will come back clean. The history being returned belongs to whatever vehicle the VIN was copied from, and that vehicle is fine, still registered and insured in another state. The database cannot tell the difference because the number being queried is a real number with a real history. Position ten is the model year, R for 2024, S for 2025, T for 2026, rotating through letters and numbers on a cycle that skips I, O, and Q because on a stamped plate, those three are too close to 1, 0, and 0. They do not appear anywhere in any VIN. If one of them shows up on a plate or a title, the number is not real. Positions twelve through seventeen are the production sequence, and they make the VIN unique across a sixty year window.
The NMVTIS record adds what happened after the factory, title brands and ownership transfers and salvage designations, and odometer readings at each event, and the NICB's stolen vehicle check covers thefts reported by participating insurers. A full VIN decode plus the history, plus the theft check gets close to a complete picture on most vehicles, but a cloned VIN goes through all of it clean because the number is real. The database is returning the history of the donor vehicle. What catches cloning is the physical verification, the dashboard plate and the door jamb label, the engine bay stamps, and the partial stamps under the trunk floor, all of which were put on at the factory at different points in the process, and all of which read the same 17 characters on a vehicle that nobody has tampered with. On a cloned vehicle, at least one of them was fabricated, and the rest either disagree or got ground off. Motorcycles carry secondary VIN stamps on the frame and engine cases besides the primary at the steering head, boats have a Hull Identification Number on the transom, plus a hidden stamp per USCG rules, and the same principle applies across all of them. Every location has to match, and the math in position nine has to work.