A confirming agency must reach a primary identifying record on the originating agency's person or property — typically the originating agency's own file, an identity document, or a verified biometric — before it acts on a want, warrant, or stolen-property entry. A name match against a database entry isn't enough. The standard is independent verification that the person or property in hand is the same one the originating agency entered, and the protocol for confirming it comes from the FBI's National Crime Information Center operating manual and the originating agency's own record.
What "Confirming a Hit" Actually Means Under NCIC Rules
"Hit confirmation" is a defined term in NCIC policy. When a criminal justice agency queries the system and gets a possible match — a "hit" — that agency becomes the "hit agency." It must then contact the "originating agency" (the one that entered the record) and confirm that the record is still valid and that the subject in custody or property in hand is the entered person or property. NCIC's operating manual uses those exact labels, and the distinction matters.
The NCIC Operating Manual, administered by the FBI's Criminal Justice Information Services Division in Clarksburg, West Virginia, sets a priority schedule for hit confirmations based on the type of record. Under the manual's hit-confirmation requirements, a hit on a person wanted on a felony warrant carries a higher urgency than a hit on a vehicle of interest in an investigation. Agencies that treat every hit as equally routine violate the schedule.
Confirmation is a two-part act: validating the record and identifying the subject. Validate means the originating agency tells the hit agency the entry is still active and accurate. Identify means the hit agency demonstrates to the originating agency that the person or property matches the entry's specific identifiers, not just a surname or a plate.
The confirmation travels back to the originating agency, which then decides whether to take custody, request extradition, or release the subject. The hit agency does not get to make that call. NCIC's own documentation states that confirmation is required before the hit agency takes any action based on the record, including detention beyond the legal limit for a Terry-type stop.
The term you'll see misapplied: "hit" versus "match." A match is a system response. A hit is a match that has been or is being confirmed. Officers sometimes say "we got a hit" when they mean "we got a possible match," and that sloppy language is how a person ends up detained on a record that was cleared three weeks earlier by the originating agency but never purged from a downstream system.
The Identifiers That Satisfy Confirmation for a Person
For a person hit, the confirmation package the hit agency must assemble includes name, date of birth, and at least one government-issued identifier — Social Security number, driver's license number, state identification number, or FBI Universal Control Number (UCN). NCIC's person files (the Wanted Person File, the Missing Person File, the Protection Order File, and others) carry different mandatory fields, and the manual specifies which identifiers are "confirmable" for each.
A name and date of birth alone is weak confirmation. NCIC's own quality-assurance guidance flags common-name and twin-birth cases as recurring sources of misidentification. The manual pushes agencies toward a photographic or biometric confirmation when a felony warrant is involved and the subject is in custody. That means comparing a booking photo to the originating agency's file photo, or running a fingerprint card through the originating agency's criminal history record.
The originating agency must be able to say, on the record, that the subject in question is the person in its file. If the originating agency can't reach its own file — a records clerk is off shift, the file is archived, the agency's terminal is down — the hit agency has not confirmed anything, no matter how many database fields align. This is the failure case most training material skips: the record exists, the identity matches, but the originating agency's records custodian is unreachable, and the subject sits in a holding cell until the confirmation lands. NCIC's manual requires the hit agency to document the delay and the reason.
Some person files, notably the Protection Order File, carry their own confirmation rules because the underlying order may have expired, been vacated, or been modified by the issuing court. A hit on a protection order is not confirmed until the originating agency verifies the order's current status with the issuing court. That chain — hit agency to originating agency to court — is where more protection-order hits fail than any other.
If the subject in custody refuses to give a name or gives a false one, the hit agency cannot simply match the record to the false name. NCIC's guidance on unidentified persons says the hit agency must attempt to establish identity through other means — fingerprint comparison, tattoos or distinguishing marks recorded in the file, or a physical description comparison — and must document the attempts before releasing the subject or holding for the originating agency.
The Identifiers That Satisfy Confirmation for Property
Property hits require the same rigor applied to serialized identifiers. The NCIC stolen-vehicle file confirms on Vehicle Identification Number (VIN), and a confirmed hit requires the VIN on the vehicle in hand to match the VIN in the record after inspection, not just after a computer read. A plate-match hit on a stolen vehicle is a possible match, not a confirmed one, until the VIN is verified.
The hit agency must physically inspect the VIN, which in most vehicles means checking the dashboard plate and at least one secondary VIN location — the door jamb, the engine block, or the firewall. A cloned VIN or a swapped dash plate will produce a plate hit and a dashboard-VIN hit simultaneously with no actual match. NCIC's vehicle file guidance points agencies to the National Insurance Crime Bureau's VIN-checking protocols for secondary-location confirmation.
For stolen articles, the confirmable identifiers are serial number, owner-applied number (OAN), and for firearms the serial number plus make, model, and caliber. Firearms hits go through the NCIC Gun File and, for stolen-gun confirmation, require the hit agency to verify the serial number on the frame or receiver — not on a detachable part — against the originating agency's entry. A firearm with a defaced serial number cannot be confirmed through the Gun File and must go through the ATF's National Tracing Center.
For stolen securities, the confirmation package includes the serial number, the issuer, and the denomination. For boats, it's the Hull Identification Number (HIN), which is a 12-character identifier and is not the same as a state registration number.
The originating agency must be reached, and its records custodian must affirm the entry is current. A property hit confirmed only by a database query and an officer's visual read of a serial number is not confirmed under NCIC protocol. The originating agency's records custodian is the party that has to say the asset is still listed as stolen — a car reported stolen that was recovered two days ago but not updated in NCIC will still produce a hit.
The Chain of Access: Records Custodian, Terminal, and Document
Access in NCIC terms refers to two different things: the hit agency's access to the originating agency's records person, and the hit agency's access to the system through its own terminal. Both matter. A hit agency can have full NCIC terminal access and still fail to confirm because it cannot reach the originating agency's records custodian.
The originating agency is required under the manual to provide a point of contact for hit confirmation, and that contact is normally a records supervisor or a terminal agency coordinator (TAC). If the hit is urgent (a felony warrant on a subject in custody), the originating agency is expected to prioritize the confirmation. If the hit is non-urgent, the confirmation can run over the next business day.
The paper trail matters as much as the access. A confirmed hit should generate a confirmation message in the system and a written record in the hit agency's file that includes the date and time of the originating agency contact, the name of the records custodian who confirmed, and the specific identifiers matched. If the hit is later challenged — in a suppression motion, in a civil suit, in an audit — that record is the defense.
The originating agency can also confirm through a secondary channel, such as a certified copy of the warrant or a photograph of the stolen property matched against its own file. A fax or email of the document is not the same as the confirmation under NCIC protocol. The confirmation is the originating agency's statement that the entry is current; the document is corroboration.
Access also fails when the hit agency's terminal goes down but the query was already transmitted. The hit agency must then use its alternative — usually a telephone call to the NCIC Control Terminal Agency in its state — to complete the confirmation. That alternate channel is written into each state's NCIC operating agreement.
Five Standards That Separate a Confirmed Hit From a Possible Match
The comparison below compresses the difference between the system response and the confirmed action. Each row is a real decision point, and the manual's language on each is specific.
| Standard | What a possible match looks like | What confirmation requires | NCIC file affected |
|---|---|---|---|
| Person name | Surname and DOB align in a query | DC driver's license number or FBI UCN matches the originating agency's file | Wanted Person File |
| Person identity | Subject gives a matching name | Booking photo or fingerprints matched against originating agency's record | Any person file |
| Vehicle | Plate returns a stolen-vehicle hit | Dashboard and secondary VIN match the entry | Stolen Vehicle File |
| Firearm | Serial number returns a hit | Frame or receiver serial, plus make/model/caliber, match the entry | Gun File |
| Protection order | Order number returns a hit | Originating agency confirms order is active with issuing court | Protection Order File |
The table's right column is where the work is. A hit agency that confirms on the left column and acts is operating on a possible match. NCIC's audit findings, published in the FBI CJIS Division's annual audits, have repeatedly identified premature action on possible matches as a leading cause of wrongful detentions. The originating agency has to be the one to close the loop.
The Originating Agency's Own File Is the Only Authority
The originating agency's file is the source of truth, and no downstream system can substitute for it. That sounds obvious, but it has consequences the training material underweights. If the originating agency's file has been updated to reflect a recalled warrant, a recovered vehicle, or a served protection order, the NCIC entry should have been updated or canceled. When it hasn't been, the hit agency has a confirmed record that is substantively wrong.
NCIC's purged-record rules require the originating agency to cancel entries that are no longer valid, and the manual's audit program checks cancellation timeliness. A warrant recalled on a Monday should be canceled from NCIC by the originating agency promptly. If a hit comes in on Wednesday, the hit agency will get a response, contact the originating agency, and learn the warrant was recalled — but the confirmation process is exactly what surfaces that fact.
The originating agency's records custodian, not the hit agency's officer, is the person who can say "that entry is no longer valid." The hit agency's job in that scenario is to document the cancellation, release the subject if no other basis for detention exists, and notify the originating agency that the entry needs to be canceled officially.
If the originating agency is small and its records are on paper, the confirmation still goes through the same chain. The hit agency calls the agency's main number, reaches the on-duty supervisor, and the supervisor pulls the paper file. That process is slower but no less required. NCIC's operating manual doesn't exempt small agencies from the confirmation requirement; it just changes the channel.
Time Standards and What Happens When Confirmation Is Delayed
The manual's priority schedule sets time expectations, and the schedule is worth stating because delays are where legal exposure lives. For a person hit on a felony warrant, the hit agency is expected to request confirmation immediately and the originating agency is expected to respond with priority. For non-felony warrants and property records, the confirmation can proceed on a next-business-day basis.
A felony-warrant hit on a subject in custody cannot be held indefinitely. The hit agency is generally limited by the same probable-cause clock that governs any detention, and the confirmation delay doesn't extend it. If confirmation doesn't arrive in time, the subject is released and the hit agency documents the release. That release is not a failure of the hit agency; it's a legal necessity.
A property hit is usually lower-risk because the property isn't going anywhere. The hit agency can seize the vehicle or the firearm and hold it pending confirmation, provided the seizure is documented and the originating agency is notified. The confirmation then governs whether the property is released to the originating agency's jurisdiction or returned to the person in possession.
Delayed confirmation has a downstream cost the top training material rarely mentions. When the originating agency responds late, the hit agency's file still shows the hit as unconfirmed in the meantime, and if the record is used for any other purpose — a later stop, an insurance check, a background query — the unresolved status creates ambiguity. The fix is simple: the hit agency should update its own internal record with the confirmation as soon as it lands, and the originating agency should cancel the NCIC entry if the underlying matter has resolved.
Common Misreadings That Produce Wrongful Detentions
The most common error is treating a name match on a common name as identity. NCIC's own guidance on the Wanted Person File warns that names like Smith, Johnson, and Garcia produce routine matches, and confirmation must rest on a specific identifier. The second common error is treating a plate match as a VIN match. The third is failing to verify that a protection order is still active.
A fourth error happens at small agencies: the records custodian confirms the entry is active without checking whether the subject in custody is the right person. The confirmation is real but it confirms the wrong thing. The originating agency's custodian has to compare the subject's identifiers to the file's identifiers, not just affirm the file exists.
The fifth error is a system artifact. Some downstream systems cache NCIC responses, and a cached hit can be delivered after the originating agency has canceled the entry. The hit agency must not rely on a cached response for confirmation; the confirmation is a live contact with the originating agency, not a re-display of the original query result.
FAQ
Does a hit confirmation require the originating agency to send a document?
No. The confirmation is the originating agency's verbal or electronic affirmation that the entry is current and the identifiers match. A certified copy of the warrant or a photograph of the stolen property is useful corroboration, but the NCIC operating manual treats the confirmation itself — the originating agency's statement — as the operative act. Many agencies will send the document afterward for their paper file.
What happens if the originating agency can't be reached at all?
The hit agency documents the attempts, holds the subject only within the legal detention limit, and releases if confirmation doesn't arrive. For property, the item can be held longer, but the originating agency should be notified through the state's control terminal agency. Unreachable originating agencies are a known problem in rural jurisdictions and are usually resolved through a supervisor at the state control terminal agency, which can sometimes facilitate the contact.
How is confirming a protection order hit different from confirming a warrant hit?
A protection order can expire, be vacated, or be modified by the issuing court, and the originating agency may not know that yet. The manual's guidance is that the originating agency must verify the order's current status with the court before confirming the hit. A warrant hit is simpler: the warrant is either active or recalled, and the originating agency's own file is the source.
Is a fingerprint comparison required for every person hit?
No. A fingerprint comparison is required when the subject's identity is uncertain or when the hit agency needs the strongest form of confirmation. In routine felony-warrant hits where the subject has a valid driver's license that matches the originating agency's file, the license number and a photograph comparison typically satisfy the confirmation standard. The manual permits flexibility based on the risk present.
Can a hit agency confirm a hit without contacting the originating agency?
No. The originating agency is the only party that can validate the entry, because it's the party that entered it and is responsible for its accuracy. A second database query, even a live one, is not confirmation. The confirmation is inherently an interagency act, and it's the reason the protocol exists — to catch stale and inaccurate entries before they cause harm.
What if the confirmation reveals a hit on property that the originating agency says is no longer stolen?
The hit agency documents the originating agency's statement, releases the property to the person in possession, and notifies the originating agency that the NCIC entry needs to be canceled. The property isn't seized when the originating agency says the entry is stale. That's a routine outcome that the process is designed to produce, and it's not a failure — it's the protocol working.
How long does a typical confirmation take for a felony warrant hit?
For a felony warrant with a subject in custody, the target is minutes to a couple of hours, depending on the originating agency's staffing and its records system. Small agencies on paper files sometimes take several hours. The manual's priority schedule expects immediate response for felony warrants, but "immediate" is defined by the originating agency's operational reality, and delays are documented.