Key Code Security Rules and Information on GM KeyCode Look-Up Application – GM Passenger Cars & Trucks

SEOCONTENT-START

Copyright 2019 General Motors LLC. All Rights Reserved. Service Bulletin Bulletin No.: 10-00-89-009D Date: December, 2019 INFORMATION Subject: Key Code Security Rules and Information on GM KeyCode Look-Up Application (U.S. Only) Models: 2020 and Prior GM Passenger Cars and Trucks Attention: This Bulletin should be read by all parties involved in KeyCode activity, including dealer operator, partner security coordinator, sales, service and parts departments. A copy of this bulletin must be printed and maintained in the parts department for use as a reference. This bulletin has been revised to update the verbiage in the first bullet under Key Code User Agreement. Please discard Corporate Bulletin Number 10-00-89-009C. GM KeyCode Look-Up Application Please note that the KeyCode Access site is restricted. Only authorized users are allowed to access the application. Please see your Partner Security Coordinator (PSC) for site authorized users. Key code look-up currently goes back 14 previous model years from the current model year. When logging into the keycode look-up application, all users will be required to input a unique security ID. This ID was provided to your dealership Partner Security Coordinator (PSC). If you do not have a unique ID, you should consult with your PSC or contact the GlobalConnect help desk ekchelp@gmexpert.com or at 888-337-1010 prompts 1 then 2 for assistance. Please remember that keycode information should be treated with the utmost care and do not ever share your ID with anyone. Ensure you use proper documentation and be completely sure the person requesting the keycode is the owner of the vehicle or acting agent with proper credentials. Compromising keycode information, misuse of the system or fraudulent activity WILL result in suspension of use and in some cases civil or criminal prosecution. Important notes about security: • Each user must maintain and protect their password to minimize the potential for abuse of the system within the dealership. Thus, authorized users should never share their password with others. • Processes must be in place for dealership management to review the dealership’s key code activity regularly through the KeyCode Review function available in GM GlobalConnect. • The Partner Security Coordinator (PSC) must have processes in place to respond to changes within the dealership. Upon termination, an individual’s access must be turned off immediately and access should be re-evaluated upon any position changes within the dealership. • If you think your password or ID security has been breached, contact your dealership Partner Security Coordinator for a new ID. • Contact GM Security via the Awareline at 1-800-244-3460 if you suspect your ID has been used by any other user. Each user will be required to accept the following agreement each time the KeyCode application is used. Key Code User Agreement • Key codes are proprietary information belonging to General Motors Company and to the vehicle owner. The access to the GM KeyCode Look-Up Application is a privilege intended for GM dealerships to have the ability to service their local retail customers – Use of the system is not intended to provide keycodes for local auto auctions or repossession companies – misuse of the information for these purposes could result in the suspension of individual or entire dealership keycode access and/or criminal or civil prosecution. • Unauthorized access to, or use of, key code information is unlawful and may subject the user to criminal and civil penalties, and will result in key code look-up privileges being suspended. • This information must be treated as strictly confidential and must not be disclosed to anyone unless authorized. Page 2 December, 2019 Bulletin No.: 10-00-89-009D I will ensure that the following information is obtained prior to releasing any key code information: 1. Valid picture ID. 2. Vehicle registration to verify owner name and VIN. Important: The user must select I AGREE or I DO NOT AGREE on screen. • GM takes this agreement seriously. Each user must be certain of vehicle ownership and input their unique security ID before clicking on the “I agree” button. • When the ownership of the vehicle is in doubt, dealership personnel should not provide the information. • It is important to note that the Key Code Look-Up Search Results contain sensitive and/or proprietary information. For this reason GM recommends against printing it. If the Search Results are printed or written down, they must be destroyed and properly disposed to minimize the risk of improper or illegal use. • Key code requests must never be received via a fax or the internet and codes must never be provided in this manner. A face to face contact with the owner of the vehicle is the expected manner that dealers will use to release a key code or as otherwise stipulated in this bulletin or other materials. • Every key code look-up request or inquiry is retained indefinitely, in the electronic data base for GM review and dealership audit purposes. • GM will review key code look-up on a monthly basis for compliance. • Do not put yourself, or your dealership in the position of needing to “explain” a key code look-up to either General Motors or law enforcement officials. • Create a physical file to document all key code look-up transactions. This file must be retained by each dealership for a minimum of two years. • Dealership Partner Security Coordinator and/or assigned management has the ability to review all key code look-up transactions. Frequently Asked Questions (FAQs) FAQs are located in the key code help section of key code look-up. The FAQ section must be printed and located near the parts department should there be questions. FAQs included the following information. How do I comply with the Senate Bill 1542 (California Migden Law) effective January 1, 2008? (U.S. Dealers Only) General Motors has applied the Migden Law (Bill 1542) across all 50 US states. This law requires the manufacturer of a motor vehicle sold or leased on or after January 1, 2008, with a model-year of 2008 or later, except as specified, to provide a means whereby the registered owner of that motor vehicle or a family member, through a registered locksmith, can access information, and only that information, that is necessary to permit the reproduction of a key or other functionally similar device, by a registered locksmith, that will allow the registered vehicle’s owner or family member to enter, start and operate the vehicle. NOTE: Under this law, GM dealerships are not required to provide key code information directly to locksmiths. Rather, GM as the manufacturer must provide the data. GM has worked closely with the National Automotive Service Task Force to provide a mechanism for locksmiths to obtain the data required under the law. Any locksmith seeking key codes should be referred to the NASTF website at www.NASTF.org for access to key codes. Where are key codes located? General Motors provides access to key codes through three sources when a vehicle is delivered to a dealer. Vehicle key codes are located on the original vehicle invoice to the dealership. There is a small white bar coded tag sent with most new vehicles that also has the key code printed on it. Dealerships should make a practice of comparing the tag’s key code numbers to the key code listed on the invoice. Any discrepancy should be reported to the DBC immediately. Remember to remove the key tag prior to showing vehicles to potential customers. The third source for key codes is through the GM KeyCode Look-Up application in GM GlobalConnect. Key code look-up currently goes back 14 previous model years from the current model year (17 years in Canada). When a vehicle is received by the dealership, care should be taken to safeguard the original vehicle invoice and key code tag provided with the vehicle. Potential customers should not have access to the invoice or this key code tag prior to the sale being completed. After a sale has been completed, the key code information belongs to the customer and General Motors. How do I document a key code request for a dealer-owned vehicle? The dealership name should be in the “Customer Name” field. “Stock Unit” should be entered in the “Plate Number” field. The dealership location should be used in the “State/Province Registered In” field. Dealership management, specified by the dealer operator, should authorize any internal key code requests. Any clarifying explanation should be entered into the comments field. How do I request a key code for customer-owned vehicle that is not registered? Scrapped, salvaged or stored vehicles that do not have a current registration should still have the ownership verified by requesting the vehicle title, current insurance policy and/or current lien holder information from the customers financing source. If you cannot determine if the customer is the owner of the vehicle, do not provide the key code information. In these cases, a short description of the vehicle (scrapped, salvaged, etc.) should be entered in the “Plate Number” field and the dealership location should be used in the “State Registered In” field. Any clarifying explanation should be entered into the comments field. Bulletin No.: 10-00-89-009D December, 2019 Page 3 How do I handle a request for key code information from a locksmith, repossession agent or recovery company? The locksmith, repossession agent or recovery company should be directed to use the NASTF.org website. There, they will find information regarding the Vehicle Security Professional process for accessing key code information. The dealership should not provide key code information at any time to a locksmith, repossession agent or recovery company. What if I cannot obtain the “plate number” for the vehicle? Every effort should be made to obtain complete information for each request. Dealership management must be involved in any request without complete information. Place the name of the dealership manager approving the request in the “Plate Number” field. Any clarifying explanation should be entered into the comments field. Other forms of documentation include vehicle title, insurance policy, and or current lien information from the customers financing source. If you cannot determine if the customer is the owner of the vehicle, do not provide the key code information. What do I do if the registration information is locked in the vehicle? Every effort should be made to obtain complete information for each request. Each dealership will have to decide on a case by case basis if enough information is available to verify the customer’s ownership of the vehicle. Other forms of documentation include vehicle title, insurance policy, and or current lien information from the customers financing source. Dealership management must be involved in any request without complete information. Place the name of the dealership manager approving the request in the “Plate Number” field. Any clarifying explanation should be entered into the comments field. If you cannot determine if the customer is the owner of the vehicle, do not provide the key code information. Can I get a print out of the information on the screen? It is important to note that the key code look-up search results contain sensitive and/or proprietary information. For this reason, GM recommends against printing it. If the search results must be printed, store and/or dispose of the printed copy properly to minimize the risk of improper or illegal use. Who in the dealership has access to the key code application? Dealership Partner Security Coordinator will determine, and control, who is authorized to access the key code look-up application. However, we anticipate that dealership parts and service management will be the primary users of the application. The key code look-up application automatically tracks each user activity session. Information tracked by the system includes: User name, user ID, all other entered data and the date/time of access. Do I have to go through the key code orientation each time I need to get a key code? The key code orientation session is required for all “first time users” on the key code look-up application. Returning users who have completed the orientation session on the application will only have to accept the key code user agreement for each request. What if I input the VIN incorrectly? If an incorrect VIN is entered into the system (meaning that the system does not recognize the VIN or that the VIN has been entered incorrectly) the system will return an error message highlighting the incorrect information. If I am an authorized user for the key code audit application, can I access the application from home? If you are authorized user for the application, you will be able to access it as you can other GlobalConnect applications. How will users be trained on the new applications? The “Help” button on the application provides access to the frequently asked questions (FAQs), security guidelines, system usage agreement and key code orientation. Additionally, the application features a “mouse-over” function that provides users with instructions for completing each required/optional data field. Who in the dealership has access to the key code review application? Access to the key code audit application will be determined, and controlled, by the Partner Security Coordinator in the dealership. The key code audit function will only allow the authorized user to view VINs, user name, date and time of requests by your dealership. Your dealership should communicate the proper procedures for requesting key codes. Any suspicious activity either within the dealership or externally should be reported to GM via the GM Security tip line. The Awareline toll free number in the US and Canada is 1-800-244-3460, the number for Mexico is 011-800-244-7434. Whose key codes can I access through the system? At this time, the following U.S. and Canadian vehicle codes are available through the system: Chevrolet, Cadillac, Buick, Pontiac, GMC, HUMMER (H2 and H3 only), Oldsmobile and Saturn for the current model year and the 14 previous model years. Page 4 December, 2019 Bulletin No.: 10-00-89-009D What should I do if I enter a valid VIN and the system does not produce any key code information? Occasionally, the key code look-up application may not produce a key code for a valid VIN. This may be the result of new vehicle information not yet available. In addition, older vehicle information may no longer be available and occasionally some vehicle keycodes are inadvertently missed or otherwise not available. If you do not receive a key code returned for valid VIN, current model year or 14 previous model years back, you can contact the GlobalConnect Help Desk at ekchelp@gmexpert.com or 1-888-337-1010. The help desk will escalate your request to the ekc help team and they will contact you back with information/ instructions. Please do not contact the GlobalConnect Help Desk for future updates on your case. How do I document a key code request for an Engineering Analysis Associate (EAA) investigator? The EAA investigator must provide a letter on GM letterhead stating the customer’s name, VIN, product allegation resolution (PAR) case number and investigator’s name. The investigation should be verified by contacting the GM Business Resource Groups PAR Staff during normal business hours (M-F 8:00 – 5:00 EST at 1-800-231-1841/prompts #3, #1, #4). A copy of this letter, business card and driver’s license of the investigator should be retained by the dealership for documentation. How do I access key codes if the key code look-up system is down? If the key code look-up system is temporarily unavailable, you can contact the original selling dealer who may have it on file. If the customer is dealing with an emergency lock-out situation, you need to have the customer contact Roadside Assistance or OnStar®, if subscribed. Roadside Assistance no longer provides key codes to dealers and uses the same keycode look-up system dealerships do so it is possible they will not have access either. If keycode system is not available and the original selling dealer does not have the keycodes, then other measures will have to be taken to help the customer depending on the nature of the need. What should I do if the key code from the look-up system does not work on the vehicle? On occasion, a dealer may encounter a key code that will not work on the vehicle in question. In cases where the key code won’t work, you will need to verify with the manufacturer of the cutting equipment that the key has been cut correctly. If the key has been cut correctly, you may be able to verify the proper key code was given through the original selling dealer. When unable to verify the key code through the original selling dealer, GM GlobalConnect Help Desk may be contacted. If there is an original vehicle invoice available, they may be able to provide you with the keycodes the vehicle was originally built with. If the key has been cut correctly and the code given does not work, the lock cylinder may have been changed. In these situations, following the proper SI document for recoding a key or replacing the lock cylinder may be necessary. How do I document a key code request for an ESIS Investigator? The ESIS investigator must provide a letter on ESIS GM Central Claims Unit letterhead stating the customer’s name, VIN, claim number and investigator’s name. The investigation should be verified by contacting the ESIS/GM Claims Unit during normal business hours (M-F 8:00 – 5:00 EST at 1-800-888-0164). A copy of this letter, business card and driver’s license of the investigator should be retained by the dealership for documentation. How long do I have to keep key code records? Dealership key code documentation must be retained for a minimum of two years. Can I get a key code changed in the look-up system? Yes, please email the VIN and New keycodes to the ekc helpdesk along with your name and BAC (ekchelp@gmexpert.com). They will update the keycodes in the look-up system for future reference. Whose name do I put in the “Customer’s Name” field of key code look-up? Whenever a key code is requested, the actual person (not the company name) you are giving the key code information to must be put in this field. This would be the same person for which you have verified identification. Detailed comments should be included in the comments section and file if necessary. What information do I need before I can provide a driver of a company fleet vehicle keys or key code information? The dealership should have a copy of the individual’s driver’s license, proof of employment and registration. If there is any question as to the customer’s employment by the fleet company, the dealer should attempt to contact the fleet company for verification. If there is not enough information to determine ownership and employment, this information should not be provided. Bulletin No.: 10-00-89-009D December, 2019 Page 5 How do I document a request from an independent repair facility for a key code or key? The independent must provide a copy of their driver’s license, proof of employment and signed copy of the repair order for that repair facility. The repair order must include customer’s name, address, VIN, city, state and license plate number. Copies of this information must be included in your dealer key code file.

SEOCONTENT-END