The short version
Verify a VIN in three passes, in this order: proofread it and run the check-digit math (or let the free decoder do it), decode it and make the specification match the listing line by line, then match it on the dash plate, the door label, and the title with a flashlight in your hand. The arithmetic catches typos and inventions, the decode catches borrowed numbers, and the physical match catches clones. No single pass catches all three, which is why skipping any one of them undoes the rest.
"Is this VIN real?" is three questions wearing one coat. Is the number itself valid — 17 characters that pass the built-in arithmetic? Does it describe the car in the listing, or some other car? And is it physically on this car, in every place the factory put it, matching the title? A seller who texts you a VIN has answered none of them yet. The number could be mistyped, borrowed from a different ad, or copied off a legitimate car so a stolen one can wear its identity.
Each question has its own test: a few minutes of math or a free decoder for the first, a free federal lookup for the second, and a flashlight at the car for the third. Here they are in order, with the arithmetic explained all the way down — the check digit is the one part of this a scammer can't talk their way around.
First, make sure you have the number right
Most "fake" VINs are transcription errors. Every VIN issued since 1981 has exactly 17 characters and never contains the letters I, O, or Q, excluded because they look like 1 and 0. So the first pass is proofreading: count to 17 and scan for I, O, or Q. If one is there, the number is wrong — usually a zero read as an O from a blurry photo of the door sticker.
Ask the seller to type the VIN, not just photograph it; if they send a photo, retype it yourself at full zoom. The confusable pairs are predictable: 0 and O, 1 and I, 8 and B, 5 and S, 2 and Z. If a later check fails, come back here before accusing anyone — a real VIN with one wrong character fails every test below exactly the way an invented one does.
The check-digit arithmetic, all of it
Every VIN on a car built for the US or Canadian market carries a check digit in position 9, computed from the other 16 characters. Here is the whole procedure, doable on paper in a couple of minutes:
- Convert each letter to a number. A through H are 1 through 8. J through N are 1 through 5. P is 7 and R is 9. S through Z are 2 through 9. Digits keep their own value.
- Multiply each of the 17 positions by its weight. The weights, left to right, are 8, 7, 6, 5, 4, 3, 2, 10, 0, 9, 8, 7, 6, 5, 4, 3, 2. Position 9 has a weight of zero, so the check digit never counts toward its own answer.
- Add up all 17 products to get one total.
- Divide the total by 11 and keep the remainder. A remainder of 0 through 9 is the check digit; a remainder of 10 is written as the letter X.
- Compare that result to position 9 of the VIN. A match means the number is arithmetically valid. Anything else means at least one character is wrong.
A worked example, and what passing proves
Take the VIN 1M8GDM9AXKP042788, a well-known textbook example. Converting and weighting: 1×8 = 8, M(4)×7 = 28, 8×6 = 48, G(7)×5 = 35, D(4)×4 = 16, M(4)×3 = 12, 9×2 = 18, A(1)×10 = 10, X×0 = 0, K(2)×9 = 18, P(7)×8 = 56, 0×7 = 0, 4×6 = 24, 2×5 = 10, 7×4 = 28, 8×3 = 24, 8×2 = 16. The sum is 351. Eleven goes into 351 thirty-one times with a remainder of 10 — so the check digit should be X, and position 9 is X. Valid.
Now be precise about what that proves. The check digit catches an invented VIN, a fat-fingered one, and the deliberate one-character edit a seller might use to dodge a history lookup. It does not prove the number belongs to any real car, and it says nothing about a cloned VIN — a real number copied from a real car passes the arithmetic perfectly, because a factory assigned it. Two further limits: some vehicles built for other markets don't use a check digit at all, so an imported car can fail this test honestly; and a valid VIN can still be attached to a listing for a different car entirely. That's what the next two passes are for.
If you'd rather not do the math, the free NHTSA VIN decoder effectively does it for you: an arithmetically invalid VIN comes back with an error or decodes to nonsense. Knowing the procedure once just tells you what "the decoder rejected it" actually means.
The free decode: does the number describe this car?
A VIN is a specification in code. Positions 1 through 3 identify the manufacturer and country, 4 through 8 describe the model, body, and engine, position 10 is the model year, position 11 the assembly plant, and 12 through 17 are the serial number. Paste the VIN into the free NHTSA decoder and it returns that specification in plain words. Along with the recall lookup, it's one of the free checks that actually delivers — and its real job is a comparison, not a report.
Hold the decode against the listing and the photos, line by line: model year, make and model, engine size and cylinder count, body style, drive type, number of doors, assembly plant. A four-cylinder decode under a V6 listing, a sedan decode above photos of a hatchback, a model year one off from the ad — each has to be explained before you drive anywhere. Note what the decode can't do: it describes the car as built, not as it is now. A swapped engine or a repaint doesn't show. It catches identity problems, not condition problems.
Match it on the car in three places
The number in the ad has to be the number on the car and on the title, character for character. Read each aloud while someone checks the other — altered VINs usually differ in one or two characters, not all seventeen.
- The dash plate, visible through the windshield at the driver's side corner. Look for the factory's rivets: pop rivets, screws, glue, fresh paint, scratches around the edge, or a plate sitting crooked mean it has been off.
- The certification label on the driver's door or door jamb, printed with the VIN and build date. It should be one undisturbed sticker with the same finish as the surrounding paint — not peeling, re-glued, painted over, or missing.
- The title certificate the seller is holding, which must be in their name. The VIN printed on it is the one copy a seller had a chance to type, so it's the one most likely to carry a "typo."
- Hidden stamps, where you can reach them: the engine block, the firewall, or the frame on trucks and body-on-frame SUVs. When the visible VINs agree and a hidden one doesn't, you've found the car's original identity.
When the VIN decodes to a different car
A decode that describes a different vehicle has four explanations, in roughly descending order of innocence. A typo — retype the number from the door label. A listing template: dealers and high-volume flippers reuse ads and sometimes leave last month's VIN in this month's post; ask for the VIN from the car itself and re-run everything. A swapped VIN plate on a car rebuilt from parts, which is a title problem even when nobody meant to deceive. Or a clone: a stolen car dressed in the identity of a legitimate one of the same year, make, and model, with a forged title to match.
The clone is the case the arithmetic and the databases both pass, because you're looking up a real car. It's caught only by disagreement — the decode doesn't match the metal, the door label looks new, or the title trail shows this VIN titled somewhere the seller has never lived. That last piece comes from NMVTIS, the federal title database, through an approved provider, and it's worth the few dollars whenever the physical match wasn't perfect. NICB's free VINCheck adds a theft-and-total-loss lookup on the same number. If any of it points at a stolen car, don't confront the seller — walk, and let the police handle it.
One last distinction, because "is this VIN clean" is a different question from "is it real." A valid, matching VIN is real. A clean one has no theft, salvage, flood, or brand records against it — a records question for NICB VINCheck and a title-record report, not the check digit. Verify first, then check for clean: a clean history on a VIN that isn't this car's is worth nothing.