How to Verify a VIN is Real (Not Fake): 6 Quick Checks Before You Buy

Quick answer

Verify any used-car VIN with six checks: (1) confirm 17 characters and no I/O/Q letters, (2) confirm the check digit at position 9 validates, (3) confirm the first three characters decode to the manufacturer the seller claims, (4) compare every on-car VIN location for matching characters and tampering signs, (5) confirm the registration document VIN matches the on-car VIN exactly, and (6) run a full VIN history report to catch sophisticated clones. Steps 1-3 take seconds in any free VIN decoder (Carlytics free tier handles them). Steps 4-5 require seeing the car in person. Step 6 is the EUR 8.90 paid report — cheapest fraud-prevention check you can buy on a five-figure vehicle.

VIN fraud takes two main forms. The amateur version reuses a VIN from a completely different car or invents a VIN that fails the basic format rules — caught by a free decoder in seconds. The professional version clones a genuine VIN from a legitimate car (same make, same model, same year, often registered in another country) and re-stamps it onto a stolen or salvaged vehicle — much harder to catch but still detectable through careful on-car inspection plus a full history report. The six checks below work in order; the earlier checks are faster and free, the later checks need physical access or a paid report. Working through all six in order takes about 15 minutes total and catches every common form of VIN fraud before money changes hands. Skipping any of them creates the gap a scammer needs.

Run the free decoder now — handles checks 1-3 in seconds

The 6 checks, in order

1Check the VIN format and characters

A real VIN is exactly 17 characters. It uses uppercase letters and digits but never the letters I, O or Q (because they look too similar to 1, 0 and 0). If a VIN is shorter, longer, contains an I/O/Q, or includes a special character, it is either a typo or fake. This check takes one second by eye. Type the VIN into Carlytics free decoder and any format error is flagged immediately — you will not even reach the manufacturer lookup.

Red flag — Reject if: not 17 chars, contains I/O/Q, has special characters

2Verify the check digit (position 9)

Position 9 of any post-1981 VIN is a check digit calculated from the other 16 characters using a fixed weighted algorithm. North American manufacturers must use this; most European manufacturers also follow it. If you change any character of the VIN by typo or fraud, the check digit usually no longer matches. You do not need to do this math by hand — any decoder including the free Carlytics decoder validates the check digit in milliseconds. A failed check digit is a strong signal of typo or tampering.

Red flag — Reject if: check digit fails (decoder will say 'invalid VIN')

3Decode the WMI and confirm the manufacturer matches the listing

The first three characters of the VIN (the WMI — World Manufacturer Identifier) decode to a specific manufacturer. WAU = Audi Germany, WBA = BMW Germany, WVW = Volkswagen Germany, WDB = Mercedes-Benz, ZAR = Alfa Romeo Italy, VF1 = Renault France, JT2 = Toyota Japan. The free Carlytics decoder returns the WMI manufacturer in real time. If the seller is offering a BMW M3 but the WMI is VF7 (Citroen), the VIN is either typed wrong or fake. This check catches the lazy version of fraud where a scammer reused a VIN from a completely different car.

Red flag — Reject if: WMI manufacturer differs from the listed make

4Compare every on-car VIN location

Every modern passenger car has the VIN in at least three places: windshield (visible through the glass at the base on the driver side), door jamb (sticker on the driver-side B-pillar, visible when the door is open), and chassis (stamped under the bonnet, in the engine bay, or on the floor under the front seat, depending on manufacturer — the V5C or owner's manual says exactly where). All on-car VINs must match each other character-for-character. If any one differs, or if any one looks like it has been re-stamped (irregular font, fresh paint, replaced rivets), treat as a strong red flag for VIN cloning.

Red flag — Reject if: any two on-car VINs differ, or visible tampering

5Match the VIN against the V5C / registration certificate

The car's registration document (V5C in the UK, Carte Grise in France, Zulassungsbescheinigung in Germany, libretto in Italy, dowod rejestracyjny in Poland) lists the VIN. The registration document VIN must match the on-car VIN exactly — every single character. If they do not match, walk away immediately. Also check that the registration document itself is not visibly altered or photocopied; a legitimate registration document is on official paper with security features. If the seller will only show a photo or photocopy and refuses to show the original, that is itself a strong red flag.

Red flag — Reject if: V5C VIN differs from on-car VIN, or document looks altered

6Run a full VIN history report

The first five checks catch format-level fraud and obvious cloning. They do not catch a sophisticated clone where the underlying VIN is genuine but belongs to a different physical car. To catch this, run a full VIN history report. A cloned VIN often shows the legitimate car still registered in the original country while the seller in front of you claims to be the current owner locally — that contradiction is visible in the registration timeline. Carlytics paid report (EUR 8.90) returns the cross-border registration timeline, theft and salvage status, accident records and mileage history. If any of these contradict what the seller is telling you, walk away. The EUR 8.90 fee is the cheapest fraud-prevention check you can buy on a EUR 10,000+ vehicle.

Red flag — Reject if: registration history contradicts the seller's claims, theft flag, or salvage flag

What to do if a check fails

If any of the six checks fails: do not transfer money. Do not hand over a deposit. Walk away. If you have already paid, contact your bank to attempt a chargeback and report the seller to local police — VIN fraud is a criminal offense in every EU country and police forces actively investigate it. Keep all evidence: photos of every on-car VIN, screenshots of the listing, the seller's contact details, photos of the registration document. If the listing was on a major platform (Mobile.de, AutoScout24, Otomoto, Subito.it, eBay), report the listing to the platform's fraud team. The most important thing to remember is that buying a cloned-VIN car is not just a financial loss: a stolen car with a cloned VIN can be seized by police even years later, with no compensation to the buyer who acted in good faith.

Verdict

The six checks above take about 15 minutes total and catch every common form of VIN fraud. Steps 1-3 are free and run in seconds via the Carlytics free decoder. Steps 4-5 need physical access to the car and the registration document — do not skip them. Step 6 is the EUR 8.90 paid history report and is the cheapest fraud-prevention check you can buy on a five-figure used vehicle. The fee is small enough that there is no rational reason to skip it on any car worth more than a thousand euros.

For the broader 2026 buyer guide see best VIN check Europe 2026. For a free decoder comparison see best free VIN decoder. For a deeper comparison of VIN check vs license plate check see VIN check vs license plate check.

Related guides

Frequently Asked Questions

How do I know if a VIN is fake?

Run six checks. (1) Length and characters — a real VIN is exactly 17 characters and never contains the letters I, O or Q. (2) Check digit — position 9 of any post-1981 VIN is a calculated check digit; if it does not match, the VIN is invalid. (3) Factory match — the first three characters (WMI) decode to a specific manufacturer; if the seller claims a Volkswagen but the WMI decodes to Renault, the VIN is wrong or fake. (4) On-car positions — a real car has the VIN in at least three places (windshield, door jamb sticker, chassis); compare them. (5) Paperwork — the V5C/registration certificate VIN must match the on-car VIN exactly. (6) Run a full VIN history report and look for inconsistencies. Carlytics offers a free decode that catches checks 1, 2 and 3 in seconds.

What is a cloned VIN?

A cloned VIN is a VIN that was copied from a legitimate car (often the same make and model in a different country) and re-stamped onto a stolen or salvaged car. The clone passes a basic VIN-format check because the underlying VIN is real — it just belongs to a different physical car. The way to catch a clone is to compare every on-car VIN location for tampering signs (replaced rivets, fresh paint, mismatched fonts) and to run a full history report — a cloned VIN often shows the legitimate car still registered abroad while the seller claims to be the current owner locally.

Where is the VIN located on a car?

The VIN appears in at least three locations on every modern passenger car. (1) Windshield: at the base on the driver side, visible from outside through the glass. (2) Door jamb: on a metal sticker on the driver-side B-pillar visible when the door is open. (3) Chassis: stamped or etched on the chassis under the bonnet, in the engine bay, on the passenger floor, or under the rear seat depending on manufacturer. Some cars also have the VIN on engine and gearbox blocks. All on-car VIN locations should match each other and the V5C/registration certificate exactly.

What is the VIN check digit?

Position 9 of every post-1981 VIN is a check digit calculated from the other 16 characters using a specific weighted algorithm. If you change any other character of the VIN by accident or fraud, the check digit no longer matches and the VIN fails validation. North American VINs are required to use the check-digit algorithm; many European VINs follow the same rule but some manufacturers historically did not. A failed check digit is a strong signal of a typo or fraud — but a passed check digit alone does not prove the VIN is genuine, only that it is internally consistent.

What does the WMI tell me?

The WMI (World Manufacturer Identifier) is the first three characters of the VIN. The first character indicates the geographic region (W = Germany, V = France, J = Japan, 1/4/5 = USA, etc.) and the next two identify the specific manufacturer. WAU = Audi Germany, WBA = BMW Germany, WVW = Volkswagen Germany, ZAR = Alfa Romeo Italy. If the seller claims a BMW but the WMI is WAU, something is wrong. Carlytics offers a free decoder that translates the WMI to a manufacturer in real time so you can verify before going further.

Can a VIN be physically tampered with?

Yes. Common tampering: a thief grinds off the original chassis VIN and re-stamps a cloned VIN, removes and replaces the windshield VIN plate, or replaces the door-jamb sticker. Signs of tampering: irregular font on the chassis VIN, fresh paint or sealant around the stamp, rivets that look new on the door-jamb sticker (factory rivets are specific shapes), or a windshield that has clearly been replaced. Always check all three or more on-car VIN locations and compare them. If any one of them differs from the others, treat that as a strong red flag.

Is a free VIN decoder enough to verify a VIN?

A free decoder catches the easiest fraud cases (invalid format, failed check digit, manufacturer mismatch) in seconds. It does not catch a cloned VIN where the underlying VIN is genuine but belongs to a different physical car. To catch clones you need a full history report — a cloned VIN often shows the legitimate car still registered in the original country while the seller claims to be the current owner locally. Carlytics free decode handles the format-level checks; the EUR 8.90 paid report handles the history-level checks.

What should I do if I think the VIN is fake?

Do not transfer money. Do not hand over a deposit. Walk away. If the listing is on a major platform (Mobile.de, AutoScout24, Otomoto, Subito.it, eBay), report the listing to the platform. If you have already paid, contact your bank to attempt a chargeback and report to local police — VIN fraud is a criminal offense in every EU country. Keep all the evidence (photos, listing screenshots, the seller's contact information). VIN cloning is most often associated with stolen vehicles, which means buying a cloned-VIN car can result in the car being seized by police even years later, with no compensation to the buyer.