Cybersecurity for Car Dealerships: FTC Rule, DMS, Fraud

A car dealership holds the same data as a small lender, runs its whole business on one hosted platform, and moves large sums by wire, yet it is usually secured like a retail shop. Credit applications, Social Security numbers, bank details and copies of identity documents pass through the finance office every day, and most of it sits in a dealer management system (DMS) reached over an always-on connection to the provider. This guide covers what the FTC Safeguards Rule asks of dealers that finance or lease vehicles, how to manage the DMS and other suppliers as a concentrated risk, and how to stop the payment fraud that targets dealer funding and vehicle payoffs. It is written for dealer principals, controllers, IT managers and the managed service providers who support them. For the full rule text and its history, see the GLBA Safeguards Rule Guide; this page applies it to the dealership floor. It summarises the FTC Safeguards Rule position as of November 2026 and is not legal advice.

Key takeaways

Most franchised and independent dealers are covered. The FTC states that the Safeguards Rule applies to most automobile dealers who finance or lease vehicles, including dealers that only arrange financing.
The DMS is your single point of failure. The June 2024 CDK Global attack took systems offline for roughly 15,000 dealer locations and pushed many stores back to paper for about two weeks.
MFA is a rule, not a preference. 16 CFR 314.4(c)(5) requires multi-factor authentication for anyone accessing your information systems, including vendor and MSP staff with remote access.
Wire fraud is the costliest daily risk. Payoff, floor plan and wholesale payments are attractive targets; a call-back to a known number defeats most business email compromise.
The FTC must hear about larger breaches within 30 days. Since 13 May 2024 an unauthorised acquisition of unencrypted data on 500 or more consumers must be reported to the FTC no later than 30 days after discovery.

Why dealerships are a distinct risk profile

A dealership combines three businesses with different security needs: a retailer with walk-in customers and public Wi-Fi, a service workshop with shared terminals and diagnostic equipment connected to manufacturer portals, and a finance office that behaves like a consumer lender. Attackers target each part differently.

Data density: a funded deal jacket can contain a credit application, a credit report, a driving licence copy, proof of income, insurance details and bank account data. Many stores keep years of paper jackets on site as well as the electronic record.
Platform concentration: sales, F&I, parts, service, accounting and payroll often run on one DMS. When that platform or the link to it fails, almost every department stops at once.
Many external connections: lender portals, credit bureaus, manufacturer systems, CRM and digital retail tools, desking software, marketing agencies and an MSP all hold accounts or integrations. Each is a supplier the Safeguards Rule expects you to oversee.
Shared and high-turnover staff: salespeople change often, shared logins at the service desk are common, and departing staff can keep CRM or lender portal access for months if nobody owns leaver processing.
Large, routine payments: trade-in payoffs to lenders, wholesale purchases, floor plan payments and deal funding move by wire or ACH every week, which makes payment redirection fraud profitable.

What the FTC Safeguards Rule requires of a dealer

The Safeguards Rule (16 CFR Part 314) implements the Gramm-Leach-Bliley Act for non-bank financial institutions under FTC jurisdiction. The rule's definition of a financial institution names automobile dealers that lease vehicles on a nonoperating basis for at least 90 days, and the FTC's dealer FAQs state that dealers who finance or arrange financing for consumers are also covered. The FAQs describe themselves as staff guidance, not binding on the Commission.

The FAQs also draw a useful line on what counts as customer information. Approved financing or lease applications, lists of customers who financed or leased, and individual financial information are covered. A list of buyer names and addresses that shows no financing status, a general sales report or a retail delivery report with names, addresses and VINs is not customer information on its own. A database that mixes both is covered, and so is any network connected to a system that holds customer information. In practice that brings most of the dealership network into scope.

Rule section	Requirement	What it means at a dealership
314.4(a)	Designate a Qualified Individual	One named person owns the programme. It can be an MSP or group employee, but the dealer keeps responsibility and must name a senior staff member to oversee an outside Qualified Individual.
314.4(b)	Written risk assessment, repeated periodically	Covers F&I, DMS, CRM, lender portals, paper jackets, service drive, Wi-Fi and every supplier, with criteria for rating risks.
314.4(c)(1)	Access controls, least privilege	Sales staff do not need accounting or payroll in the DMS; porters do not need any customer data.
314.4(c)(2)	Inventory of data, devices, systems and facilities	Includes F&I laptops, scanners that store images, and offsite archive storage.
314.4(c)(3)	Encryption in transit over external networks and at rest	Or compensating controls approved in writing by the Qualified Individual.
314.4(c)(5)	MFA for anyone accessing information systems	Staff, managers, vendors and MSP technicians; any alternative needs written approval.
314.4(c)(6)	Secure disposal no later than two years after last use	Unless a business need or legal retention rule applies; review retention periodically.
314.4(c)(7), (c)(8)	Change management; monitoring and logging of user activity	Log DMS, CRM, email and remote access sign-ins and keep them long enough to investigate.
314.4(d)	Continuous monitoring, or annual penetration test plus vulnerability assessment every six months	Most smaller dealers meet this through scheduled testing unless they run a monitored EDR or SOC service.
314.4(e)	Security awareness training	Role-based content for F&I, accounting and the BDC, not only generic phishing modules.
314.4(f)	Service provider oversight	Select capable providers, require safeguards by contract, assess them periodically by risk.
314.4(h)	Written incident response plan	Roles, decision rights, communications, remediation and post-incident review.
314.4(i)	Written report to the board or a senior officer at least annually	The dealer principal or owner group receives it if there is no board.
314.4(j)	Notify the FTC of a notification event involving 500 or more consumers	As soon as possible and no later than 30 days after discovery, through the FTC online form.

Section 314.6 exempts institutions holding customer information on fewer than 5,000 consumers from the written risk assessment, the testing cadence in 314.4(d)(2), the written incident response plan and the annual written report. Few active dealers fall under that figure once past finance customers are counted, so check the number before relying on it. For the companion privacy notice duties and identity theft red flags, see the FTC Red Flags Rule.

The dealer management system and supplier concentration

The CDK Global incident is the reference case for this sector. Attacks beginning on 18 and 19 June 2024 led CDK to shut down most of its systems, including its data centres, and to advise dealers to disconnect the always-on VPN to those data centres. Staff at affected stores reported working with paper, spreadsheets and sticky notes. Reporting attributed the attack to the BlackSuit ransomware group, and full restoration of dealer services was expected by early July. During the outage, dealers also reported phishing calls and emails from people posing as CDK support. The lesson for each dealer is not about one provider: any hosted DMS creates the same concentration, and the controls that matter sit on the dealer side.

Supplier risk	Dealer-side control	Evidence to keep
DMS or connection outage for days or weeks	Written manual-operations plan: paper deal forms, offline price and inventory export, manual repair order process, payroll fallback	Tested runbook, dated exercise notes
Compromise travelling over the site-to-site VPN or integration	Segment the DMS link from the rest of the network; allow only required hosts and ports; be able to cut the tunnel quickly	Firewall rule set, named person authorised to disconnect
Impersonation of supplier support during an incident	Verify any "support" contact through a number from your contract, never the inbound call; no remote session without a ticket	Support contact list held offline
Third-party add-ons with DMS data access	Inventory every integration and the data it pulls; remove unused ones; contract clauses on encryption and breach notice	Integration register, contract schedule
MSP or vendor remote access	MFA on every remote tool, named accounts, session logging, access only on request	Remote access log, quarterly access review

Ask each critical supplier for its security attestations, its breach notification commitment to you, and how it would restore your data. For the general method, see Choosing an IT Support Provider or MSP Securely.

Payment and identity fraud at the dealership

Dealerships face two fraud streams: criminals stealing the dealer's money, and criminals using stolen or synthetic identities to obtain vehicles and finance. The FBI IC3 2024 Internet Crime Report recorded 21,442 business email compromise complaints with reported losses of about 2.77 billion US dollars, which shows the scale of the first stream.

Payoff and wholesale redirection: an attacker in a compromised mailbox, or on a look-alike domain, sends "updated" bank details for a lender payoff, a wholesale purchase or an auction settlement. Control: any new or changed payee bank details are confirmed by phone to a number already on file, by someone other than the requester, before the first payment. See the Business Email Compromise Awareness for Finance Teams Guide.
Executive impersonation: urgent requests "from the dealer principal" for wires or gift cards. Control: a written rule that no payment instruction is accepted from email or text alone, and dual approval above a set amount.
Callback scams: a fake invoice or support notice tells staff to phone a number, where they are talked into installing remote access software. See the Callback Phishing (TOAD) Guide.
Identity fraud on credit applications: stolen or synthetic identities, altered pay stubs and fake driving licences. Control: a written Red Flags programme in F&I, document verification, and an escalation path when details do not match the bureau file.
Website chatbots and digital retail: a public chatbot speaks for the store. A Chevrolet dealer's website chatbot was talked into offering a $1 Tahoe in December 2023, a reminder that commitments and prices must be enforced outside the model. See the Chevrolet Dealer Chatbot 2023 case.

Mapped to ATT&CK, these are mainly T1566 Phishing and T1078 Valid Accounts for entry, T1199 Trusted Relationship where a supplier is the route in, and T1657 Financial Theft as the goal.

Where identity fits

Most dealer incidents start with an account, not an exploit. Four identity controls carry most of the weight:

Named accounts everywhere: remove shared logins at the service desk, parts counter and BDC. Shared accounts make the logging duty in 314.4(c)(8) meaningless because nobody can be identified.
MFA on email, DMS, CRM, lender portals and remote access: prefer authenticator app number matching or security keys for F&I, accounting and administrators. See the Phishing-Resistant MFA Guide.
Same-day leaver processing: sales staff often hold access in five or more systems. One checklist, owned by the office manager, removes all of them on the last day.
Non-human accounts: integrations between the DMS, CRM, desking tools and lender platforms use API keys and service accounts. Record each one, its owner and its scope, and rotate credentials when a supplier relationship ends.

Building the programme: a phased approach

Weeks 1 to 4, ownership and inventory: appoint the Qualified Individual in writing. List every system holding customer information, every supplier with access and every location where paper deal jackets are stored. Confirm whether you exceed 5,000 consumers.
Weeks 3 to 8, quick risk reduction: turn on MFA for email and remote access first, then DMS, CRM and lender portals. Pilot with managers and F&I, then roll out by department. Keep a written exception list approved by the Qualified Individual, with an end date for each exception. Introduce the payment call-back rule immediately; it costs nothing.
Months 2 to 3, risk assessment and policy: write the risk assessment with a simple likelihood and impact scale. Write the incident response plan, including the manual-operations plan for a DMS outage and the FTC notification decision.
Months 3 to 6, technical controls: encrypt laptops and backups, segment guest and service-drive Wi-Fi from business systems, deploy endpoint detection (see the EDR Guide), centralise logs, and set up immutable or offline backups of locally held data.
Months 4 to 9, suppliers and testing: update contracts with safeguard and breach notice clauses. Commission the vulnerability assessments every six months and the annual penetration test unless continuous monitoring is in place. Run a tabletop exercise on a DMS outage and on a payoff wire fraud.
Annually, report and adjust: the Qualified Individual reports in writing to the owner or board, and the programme is updated from test results, incidents and changes such as acquiring another rooftop.

Rollback and testing: stage MFA so that a failed rollout affects one department, keep break-glass administrator accounts stored securely, and test a backup restore before relying on it in the incident plan.

Decision guidance: single rooftop or dealer group

Decision	Single store	Dealer group
Qualified Individual	Often the controller with an MSP providing technical support; name a senior overseer if the QI is external	A group IT or security lead, with a named contact at each rooftop
Monitoring	Annual penetration test and six-monthly vulnerability assessments are usually simpler than a 24/7 service	Continuous monitoring through a managed detection service becomes cost-effective and meets 314.4(d)
Identity	Cloud email with MFA and a password manager for shared supplier portals	Central identity provider with single sign-on into DMS, CRM and lender tools where supported
Acquisitions	Not applicable	Treat each new rooftop as untrusted until assessed: separate network, reset credentials, review suppliers
Outage resilience	Printed forms and an offline inventory export	Group-wide manual-operations plan, cross-store support, and pre-agreed communications

Cyber insurance is a common driver as well: underwriters ask about MFA, backups and EDR. See Identity Controls for Cyber Insurance Questionnaires Guide.

Detection and measurement

Log at least: email and identity provider sign-ins, MFA changes and new inbox rules; DMS and CRM user creation, privilege changes and bulk exports; remote access tool sessions; firewall and VPN events; and changes to vendor or payee bank details in accounting. Alert on sign-ins from new countries, inbox forwarding to external addresses, and new remote access software on any endpoint.

MFA coverage: percentage of accounts in email, DMS, CRM and remote access with MFA enforced; target 100 percent with documented exceptions.
Leaver time: median hours from last working day to removal of all access; target same day.
Payee change verification: share of bank detail changes with a recorded call-back; target 100 percent.
Supplier coverage: share of suppliers with customer data access that have current contract clauses and a review in the last 12 months.
Restore confidence: date of the last successful test restore and of the last manual-operations exercise.
Remediation time: days to close high-risk findings from vulnerability assessments.

Common failure patterns

Treating the DMS provider as the whole programme: the provider secures its platform; access control, endpoints, email and the network that connects to it remain the dealer's responsibility under the rule.
No plan for a long outage: stores that had never practised paper deals lost sales and payroll accuracy when their DMS went down in 2024.
Shared F&I and service logins: they defeat least privilege and make investigation impossible.
Bank detail changes accepted by email: the most direct path to a six-figure loss on a payoff or wholesale deal.
MSP accounts without MFA: the FTC FAQs give a service provider with direct network access as the example of who must use MFA.
Old deal jackets kept forever: paper and scanned files beyond the retention need increase breach size and the count of consumers for notification.

Framework mapping

Dealer control	NIST CSF 2.0	NIST SP 800-53 Rev 5
Qualified Individual and annual report	GV.OV Oversight	PM-2 Information Security Program Leadership Role
Written risk assessment	ID.RA Risk Assessment	RA-3 Risk Assessment
MFA and least privilege	PR.AA	IA-2 Identification and Authentication
Supplier oversight, DMS concentration	GV.SC	SA-9 External System Services, SR-6 Supplier Assessments and Reviews
Monitoring and logging	DE.CM Continuous Monitoring	AU-2 Event Logging, SI-4 System Monitoring
Training	PR.AT	AT-2 Literacy Training and Awareness
Incident response and FTC notice	RS.MA Incident Management	IR-4 Incident Handling, IR-6 Incident Reporting
Backups and manual operations	RC.RP Incident Recovery Plan Execution	CP-9 System Backup

Practitioner checklist

Appoint the Qualified Individual in writing and name a senior overseer if that person is external.
Count consumers with customer information on file and record whether the 5,000 exemption applies.
Enforce MFA on email, DMS, CRM, lender portals and all vendor and MSP remote access.
Remove shared logins and process leavers on their last day across every system.
Adopt a call-back rule for any new or changed payee bank details, with dual approval for large wires.
Write and exercise a manual-operations plan for a multi-week DMS outage.
Segment the DMS connection and guest Wi-Fi from business systems; know who can cut the link.
Update supplier contracts with safeguards and breach notice clauses; review suppliers yearly by risk.
Schedule vulnerability assessments every six months and an annual penetration test, or run continuous monitoring.
Add the FTC 30-day notification decision and the online form to the incident response plan.

Cybersecurity for Car Dealerships: Safeguards Rule Duties, DMS Risk and Fraud Controls