Vehicle thefts in the United States dropped to 659880 in 2025, down 23 percent from the year before and the lowest number in several decades, according to the NICB. The 2024 total had already fallen 17 percent from the 2023 peak of over a million reported thefts. The numbers are going in the right direction. VIN cloning is not. The NICB has been flagging cloning as a growing pattern for years now, and the decline in outright theft has not slowed it down because cloning does not require stealing a vehicle in the traditional sense. It requires copying a VIN from a legitimate vehicle and putting it on a stolen one, and the entire operation depends on the buyer only checking one VIN location. The federal requirement under 49 CFR Part 565 puts the primary VIN on a plate visible through the windshield on the driver's side dashboard, riveted through the firewall at the base of the glass. That is where most VIN checks start and stop. The plate is supposed to be readable from outside the vehicle through the glazing without moving anything, and it is, and that is the problem. The one location everybody looks at is the one location that gets cloned.
The dashboard plate on most production vehicles is made from a foil material that destroys itself if somebody tries to peel it off. Cloning operations fabricate replacement plates rather than transplanting originals. A fabricated plate that matches the font spec, the character spacing, and the rivet pattern will pass a visual check from outside the windshield without much trouble. What won't pass is a comparison against the other VIN locations on the same vehicle. The Safety Compliance Certification Label sits on the driver's side door jamb, printed during assembly with the VIN, along with the gross vehicle weight rating, tire pressure specs, and the manufacturing date. That label is produced separately from the dashboard plate at a different point in the assembly process. On a legitimate vehicle, both locations print the same the 17 characters decoded. On a cloned vehicle, one of them is real, and the other one is a reproduction, and the differences between a factory label and a reproduction show up in the font weight, the character spacing, or the ink color if you put the two next to each other. Most people never open the door and look. The engine bay carries additional stamps on the firewall, the front crossmember, or the block itself, depending on the manufacturer. Factory stamps from a die press have consistent depth and even spacing across all 17 characters. A restamp looks different. The depth varies, the characters sit at slightly different angles, and the spacing between them is not uniform. Not every manufacturer stamps every location, but checking takes less than a minute, and the NICB recommends it on any vehicle where the dashboard and door jamb create any doubt at all.
The trunk and cargo area is a location that almost nobody checks, and that is exactly what makes it useful. Many manufacturers stamp the last six to eight characters of the VIN on the frame rail or the inner wheel well under the spare tire floor. Getting to that stamp on most vehicles requires lifting the cargo mat and the spare tire cover, and altering it requires access to the underside of the vehicle with equipment that a cloning operation in a rented garage is unlikely to have. A partial stamp there that matches the tail end of the dashboard VIN is about as close to a confirmation of authenticity as a physical inspection can get. A stamp that has been ground down and restamped, or one that is missing on a model that should have it, means the vehicle went through a professional VIN alteration. The vehicle history report and the NMVTIS record should be cross checked against every physical location. The NMVTIS record carries the VIN as recorded at each title event across every state the vehicle was registered in, and a VIN check against the federal database will flag a stolen vehicle check result if the number has been reported. But a cloned VIN is not the stolen vehicle's VIN. It is a copy of a legitimate VIN from a legitimate vehicle, and the NMVTIS record for that number will come back clean because the vehicle it was copied from is clean. That is the gap that cloning exploits, and it is the reason that a database check alone does not close the loop on vehicle identity. The physical locations have to match each other, and they have to match the documents.
Title paperwork, registration, and the insurance card all carry the VIN as it was recorded at issuance. Any difference between those documents and the physical stamps is a different kind of problem than a mismatch between two physical locations, but both of them need an explanation before any money moves. A seller who says the title VIN and the dashboard VIN don't match because of a clerical error at the DMV is telling a story that almost never checks out. The national theft rate fell to 97.33 per 100000 in the first half of 2025, down from 126.62 the year before, and the top ten metro areas by volume still accounted for more than a third of all thefts nationally. The crime is concentrated, and so is the cloning that feeds off it. California led the country in metro area theft rates and has been a major source state for cloned vehicles moving into other markets for years. A vehicle that shows up for private sale with out of state plates, no lien, and a price that sits just far enough below market to attract attention without looking suspicious is the profile, and the VIN check on the dashboard will come back clean because the VIN on the dashboard belongs to someone else's truck that is still sitting in their driveway in another state.
Boats use a Hull Identification Number on the transom and a second stamp in a hidden location per USCG requirements. Motorcycles carry the VIN at the steering head with secondary stamps on the frame and engine cases. The principle is the same for all of them. Multiple locations, independently produced, should all agree with each other. When they don't, the mismatch is the finding.