# Email security for auto dealerships: the risks and what the FTC expects

URL: https://iblockspam.com/blog/email-security-for-auto-dealerships
Last updated: 2026-10-16
Published: 2026-10-16
Topic: Phishing & threats
Author: iBlockSpam Team

> Email risks for car dealers: credit apps in inboxes, payoff and wire fraud, fake lead emails and the FTC Safeguards Rule, with a dealership email checklist.

## Short answer

Auto dealerships are targeted because sales staff open email from strangers, F&I offices handle credit applications, and large payoffs and wires move by email. Dealers that finance or lease are covered by the FTC Safeguards Rule, which requires MFA and encryption. Keep credit data out of email, verify payment changes by phone, publish DMARC and filter inbound mail.

A car dealership sends and receives more sensitive email than most small businesses. Sales and BDC (business development center) staff answer internet leads from strangers, F&I (finance and insurance) managers swap documents with lenders, and the office pays off trade-in loans and wires money to auctions and wholesalers. Dealers that arrange financing are also regulated financial institutions. This guide covers the email risks specific to dealerships, what the FTC expects, and a checklist that fits a store's daily routine.

## Why are car dealerships targeted by email attacks?

Car dealerships are targeted because they combine high-value payments, regulated customer financial data and staff who must respond to unsolicited email quickly. A sales team that ignored messages from unknown senders would lose leads, so criminals can always get a message read.

Four features make dealers attractive:

- **Credit data in circulation.** Credit applications, pay stubs, driver's licenses and insurance cards travel between customers, F&I and lenders.
- **Big, routine payments.** Trade-in payoffs, wholesale purchases and dealer trades involve wires and ACH transfers arranged by email.
- **Many shared inboxes.** `sales@`, `internet@` and `service@` addresses are often shared logins used by rotating staff.
- **Software dependency.** Many dealers depend on a single dealer management system (DMS) provider for daily work. When CDK Global had a cybersecurity incident in June 2024, Group 1 Automotive told the SEC it "has disrupted the Company's business applications and processes in its U.S. operations", and its stores worked with "alternative processes" ([Group 1 8-K](https://www.sec.gov/Archives/edgar/data/1031203/000103120324000048/gpi-20240619.htm)). Outages push staff onto email and phone, where verification habits slip.

## What does the FTC Safeguards Rule require from dealers?

The FTC Safeguards Rule (16 CFR Part 314) requires dealers that finance or lease vehicles to run a written information security program that protects customer information, including MFA, encryption, training, service provider oversight and breach reporting. The FTC's [FAQ for auto dealers](https://www.ftc.gov/business-guidance/resources/automobile-dealers-ftcs-safeguards-rule-frequently-asked-questions), dated June 2025, says dealers "who finance (or facilitate the financing of) automobiles for consumers are financial institutions", and so are dealers that lease vehicles for longer than 90 days.

Points from that FAQ that matter for email:

- **What's protected.** "Customer information" includes application data and records derived from it. Shoppers who only ask questions, pay cash or bring outside financing generally aren't "customers" under the rule, but their data still deserves care.
- **You keep the duty.** Arranging a loan creates a continuing relationship, so you must protect the information for as long as you hold it, even if you don't "hold the paper".
- **Breach reporting.** A "notification event", meaning unauthorized acquisition of unencrypted information of at least 500 consumers, must be reported to the FTC "as soon as possible – and no later than 30 days after discovery".
- **Vendors.** You must select, contract with and periodically assess service providers, and oversee any provider with direct access to your systems.

The rule itself ([eCFR](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314)) requires multi-factor authentication "for any individual accessing any information system" and encryption of customer information "both in transit over external networks and at rest". Our [FTC Safeguards Rule email guide](https://iblockspam.com/blog/ftc-safeguards-rule-email-security) maps each requirement to email controls in detail. This guide doesn't give legal advice; ask counsel how the rule applies to your dealership.

## What email scams target car dealers?

Dealers see general phishing plus scams built around how stores buy, sell and pay.

| Scam | What arrives | Who it targets | How to check |
|---|---|---|---|
| Payoff or wire redirection | "Updated wiring instructions" for a lien payoff, auction or wholesale deal | Office, accounting | Call the lender or seller on a number you already had |
| Fake internet lead | A "customer" inquiry with a link or attachment, such as a "trade-in photos" file | Sales, BDC | Open nothing unexpected; leads come through the CRM |
| Credential phish | A fake lender portal, OEM portal or Microsoft 365 sign-in page | F&I, managers | Use bookmarks; MFA on every portal |
| Dealer impersonation | A lookalike of your domain asking customers for a deposit | Your customers | DMARC; tell buyers how you take payment |
| Payroll diversion | A "salesperson" asks to change direct deposit before commission day | Payroll | Confirm in person |

### Payoff and wire fraud

Business email compromise (**BEC**) is fraud where a criminal impersonates, or takes over, a trusted email account to redirect money. The FBI's IC3 recorded 24,768 BEC complaints in 2025, with $3,046,598,558 in reported losses across all industries ([IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). For a dealership, trade-in payoffs and wholesale wires are likely targets, because the amounts are large and the timing is predictable.

Here's an example of the kind of message to stop and verify:

> Example: "Hi, regarding the payoff for the 2022 Tahoe you took in on trade, please note our remittance account has changed. Updated wire instructions attached. Please send today to avoid an additional per diem charge."

The FBI's first prevention tip is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information" ([IC3 PSA I-091124-PSA](https://www.ic3.gov/PSA/2024/PSA240911)). Our [vendor invoice fraud guide](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) has a full call-back procedure, and [payroll diversion scam emails](https://iblockspam.com/blog/payroll-diversion-scam-emails) covers commission and pay change requests.

## How do you keep credit applications out of email?

Keep credit applications out of email by moving every document that contains customer financial information into systems built for it: your DMS, lender portals or an encrypted upload link. Plain email attachments sit in multiple mailboxes, phones and sent folders for years, and one stolen password exposes all of them.

1. **Set a written rule:** no credit applications, Social Security numbers or full bank details in email.
2. **Give customers a secure upload option** and say so in your lead replies and website forms.
3. **Search existing mailboxes** for old credit applications and deal jackets, and delete what you don't need under your retention policy. See [email retention policy for small business](https://iblockspam.com/blog/email-retention-policy-small-business).
4. **Require TLS for mail with lenders** where your platform allows it, and publish [MTA-STS](https://iblockspam.com/blog/mta-sts-tls-rpt-explained) for inbound mail.
5. **Use message encryption** when a document must go by email. Our guide to [email encryption types](https://iblockspam.com/blog/email-encryption-types-for-business) explains the options.

## How should a dealership set up email accounts?

Give every salesperson, BDC agent, F&I manager and office user their own account with multi-factor authentication (**MFA**), a second check at sign-in beyond the password. The Safeguards Rule requires MFA and activity logging for anyone accessing your information system, and CISA's joint phishing guidance says to prioritize phishing-resistant MFA for administrator and privileged accounts, such as those with "broad access to customer or financial data" ([CISA](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)).

- **Shared lead addresses as shared mailboxes,** opened by named users, not one password passed around the showroom. See [shared mailbox spam protection](https://iblockspam.com/blog/shared-mailbox-spam-protection).
- **Fast offboarding.** Sales staff turn over often. Disable accounts on the last day and check for forwarding rules. See [employee offboarding email security](https://iblockspam.com/blog/employee-offboarding-email-security).
- **Protect your domain.** Publish SPF, DKIM and DMARC so criminals can't send from your exact domain to customers asking for deposits. CISA asks organizations to "ensure DMARC is set to 'reject' for sent emails". A record at enforcement (example domain):

```
_dmarc.example-motors.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-motors.com"
```

DMARC doesn't stop lookalikes such as `examplemotors-sales.com`. For those, see [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

## Is Microsoft 365 or Google Workspace filtering enough for a dealership?

For a single rooftop, the built-in filtering in Microsoft 365 or Google Workspace, combined with MFA, DMARC and a payment verification rule, is a reasonable baseline. Neither a built-in filter nor a separate one replaces the call-back procedure, because a payoff request from a compromised lender mailbox can pass every authentication check.

A separate MX-level filter helps when:

- **You run several rooftops or brands,** each with its own domain. Per-domain pricing with unlimited mailboxes (mailbox count, not message volume) suits high-turnover sales floors.
- **Staff need to find held leads.** Each user gets a personal quarantine with scheduled digest emails, so a real lead caught as suspicious isn't lost.
- **You want attachment and macro rules** applied before mail reaches any phone in the showroom.
- **Your mail server goes down.** Mail is held for up to 5 days and delivered when it's back.

It's also a service provider under the Safeguards Rule, so assess it like any other. No email product, including iBlockSpam, makes a dealership compliant on its own. The [Microsoft 365 platform page](https://iblockspam.com/platforms/microsoft-365) shows how iBlockSpam sits in front of Microsoft 365.

## Dealership email security checklist

1. Turn on MFA for every mailbox, DMS, CRM and lender portal login.
2. Replace shared sales and service logins with shared mailboxes opened by named users.
3. Ban credit applications and Social Security numbers in plain email, and offer a secure upload.
4. Confirm every new or changed payoff, wire or payroll instruction by phone on a known number.
5. Keep an offline list of lender, auction and vendor phone numbers for use during outages.
6. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
7. Block risky attachment types from outside senders. See [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types).
8. Write down how you'll assess a mailbox compromise against the FTC's 500-consumer, 30-day reporting rule.

## Next steps

- Check your store's SPF, DKIM and DMARC with the free [Email Health Check](https://iblockspam.com/tools/email-health-check).
- Read the requirement-by-requirement [FTC Safeguards Rule email guide](https://iblockspam.com/blog/ftc-safeguards-rule-email-security) with your Qualified Individual.
- Share the payoff example above with your office and F&I team this week.
- If your store runs on Microsoft 365, see how iBlockSpam adds an inbound filtering layer on the [Microsoft 365 page](https://iblockspam.com/platforms/microsoft-365).

More threat guides are in our [phishing and threats topic](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Does the FTC Safeguards Rule apply to car dealerships?

It applies to dealers that finance or facilitate financing of vehicles for consumers, and to dealers that lease vehicles for longer than 90 days. The FTC's June 2025 FAQ for dealers says the duty to protect customer information continues for as long as you hold it, even if you don't hold the paper on the loan.

### Can car salespeople email credit applications?

Avoid it. Credit applications contain the customer information the Safeguards Rule protects, and the rule requires encryption of customer information in transit over external networks and at rest. Use your dealer management system, a lender portal or an encrypted upload instead of plain email attachments, and ask counsel how the rule applies to your store.

### How do criminals steal money from car dealers by email?

A common route is business email compromise: a criminal impersonates, or takes over, the mailbox of a lienholder, auction, wholesaler or customer and sends new bank details just before a payoff or wire is due. The fix is procedural. Confirm any new or changed payment instructions by calling a number you already had.

### What should a dealership do if a mailbox is hacked?

Reset the password and sessions, check the mailbox for new forwarding and inbox rules, and find out which customer files it held. If unencrypted information of at least 500 consumers may have been acquired, the Safeguards Rule requires notifying the FTC within 30 days of discovery. Involve your Qualified Individual and counsel early.

### Do BDC and sales staff need their own email accounts?

Yes. The Safeguards Rule requires multi-factor authentication for anyone accessing your information system and logging of authorized users' activity. A shared sales@ login can't give each person their own MFA or a record of who opened what. Keep shared lead addresses as shared mailboxes that named users open with their own accounts.

## Sources

- [FTC: Automobile Dealers and the FTC's Safeguards Rule, Frequently Asked Questions (June 2025)](https://www.ftc.gov/business-guidance/resources/automobile-dealers-ftcs-safeguards-rule-frequently-asked-questions)
- [eCFR: 16 CFR Part 314, Standards for Safeguarding Customer Information](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314)
- [FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI IC3 PSA I-091124-PSA: Business Email Compromise, The $55 Billion Scam (September 2024)](https://www.ic3.gov/PSA/2024/PSA240911)
- [Group 1 Automotive, Form 8-K (event June 19, 2024, filed June 24, 2024): CDK Global cybersecurity incident](https://www.sec.gov/Archives/edgar/data/1031203/000103120324000048/gpi-20240619.htm)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance, Stopping the Attack Cycle at Phase One (October 2023, PDF)](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [MTA-STS Checker](https://iblockspam.com/tools/mta-sts-checker): Fetch and validate your MTA-STS policy, match it to your MX hosts and check TLS-RPT.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-auto-dealerships (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt