Protect Your Automobile
Everything needed to run a small-group roundtable for a dealership: the car itself, Wi-Fi in the car, free Wi-Fi on the lot, financing when someone buys, and the parts that arrive later. Includes a facilitator plan, agenda, discussion prompts, a four-stage tabletop, and a one-page handout.
Join to save this for later.
- 31,675identity theft complaints reported to the FBI in 2025
- $186Mreported lost to identity theft in 2025
- 18,774credit card and check fraud complaints in 2025
- $3.05Breported lost to business email compromise in 2025
As of 2025. Source: FBI Internet Crime Complaint Center (IC3) 2025 Annual Report
Outcomes
- Name the four places a deal can be turned: the car, the showroom Wi-Fi, the financing, and the parts order.
- Keep guest Wi-Fi away from finance, service, and the parts system.
- Call back on a number you already trust before a payment account changes.
- Deliver the car with the buyer's own Wi-Fi password, and with test-drive phones removed.
Agenda
| Time | Block | What happens |
|---|---|---|
| 0:00–0:10 | Welcome and hook | The general manager opens. The facilitator tells one story about a down payment sent to a new account. Ground rules. |
| 0:10–0:25 | Story round | Each person shares a suspicious email, a Wi-Fi page, a paired phone, or a parts invoice. Capture themes on a flip chart. |
| 0:25–0:50 | Guided discussion | Work through 3 or 4 topics chosen from what the story round brought up. |
| 0:50–1:10 | Tabletop scenario | Groups of 3 or 4 work through The Saturday Deal, one stage at a time, then report back. |
| 1:10–1:20 | Gap check | Sticky notes: one thing in our process that worries me. Group them and rank them. |
| 1:20–1:30 | Commitments and close | Walk the handout. Each person names one habit they will start this week. |
Discussion topics
Vehicle security
A key fob, an app login, and a phone left paired to the car are ways to open it after it leaves the lot.
- What do we do when a fob or an app login is lost before delivery?
- Who removes test-drive phones from the car before the buyer drives away?
Cars that offer Wi-Fi
A new car can carry its own hotspot. The password should not be the office password, and the buyer should set their own before they leave.
- Do we turn on the car's hotspot during a test drive?
- When does the buyer change that password: on the lot, or never?
Dealerships that offer free Wi-Fi
Guest Wi-Fi is for customers. A credit application, the finance system, and the parts system do not belong on it.
- Can a phone on guest Wi-Fi reach the system that stores a credit application?
- What would a fake sign-in page on our Wi-Fi ask the buyer to type?
Financing concerns when you buy a car
The application holds a name, an address, an income, and a down payment. A last-minute email can also move where that money goes.
- Who reads the application with the buyer before it is sent?
- If the down-payment account changes by email, what number do we call?
Supply chain concerns with auto parts
A module, a key, or a part can arrive from a supplier you did not mean to pay, or it can fail to match the vehicle.
- How do we confirm a new bank account on a parts invoice?
- What happens to a part that does not match the VIN?
The Saturday Deal
Give each group one stage at a time, about 5 minutes apart. Groups answer each stage's question before seeing the next.
Saturday, 10 a.m., on the showroom floor
The buyer joins the free Wi-Fi to finish a credit application on their phone. A page pops up that looks like the dealership and asks them to sign in again, including the application.
What do you tell the buyer to do with that page?
Saturday, 11 a.m., in finance
An email from the lender says the down-payment account has changed and asks the buyer to send the money today. The logo looks right. The buyer is ready to leave.
Is the account change confirmed? What number do you use?
Saturday, 1 p.m., in the car
The car offers its own Wi-Fi. To keep the buyer online, a salesperson turns the hotspot on with the office password and pairs the buyer's phone for the test drive.
What has to change before this car is delivered?
Monday, in parts
A supplier email gives a new bank account for a module the car is waiting on. The part that arrives does not match the VIN. The supplier you usually call says they did not send the invoice.
Do you pay the invoice, and do you put the part on the car?
Reveal debrief
- Guest Wi-Fi does not carry a credit application. A sign-in page you did not post is closed, and the buyer starts again on a dealership device.
- A payment account changes only after a call to a number you already have for the lender. The number in the email is not that call.
- The car leaves with the buyer's own hotspot password. Test-drive phones are removed. The office password is not the car's password.
- The parts invoice is confirmed with the supplier you already use. A part that does not match the VIN is not installed.
Handout
Habits
- Keep guest Wi-Fi separate from finance, service, and the parts system.
- Do not take a credit application on guest Wi-Fi.
- Call back before a down payment or a parts payment changes accounts, using a number you already trust.
- Set the car's Wi-Fi password with the buyer before delivery, and remove phones paired on the test drive.
- Treat a lost key fob or app login like a lost key.
- Match the person, the ID, and the application before the loan is sent.
Red flags
- A guest Wi-Fi page that asks for a password or a credit application
- A last-minute change to where a down payment or a parts invoice should be paid
- A sender address one letter off from the lender or the supplier
- A car hotspot that uses the office password
- A phone still paired to a car that is ready for delivery
- A part, key, or module that does not match the VIN
First hour
- Bank. The buyer or the dealership calls the bank now and asks to stop or recall the payment.
- Report. File at ic3.gov with the transaction details.
- Notify. The general manager, the lender, and the supplier you already use.
- Contain. Take down a Wi-Fi page you did not post, reset the changed account, and hold any part that does not match the VIN.
Facilitator checklist
2 weeks before
- Confirm the date, the room, and who is coming with the general manager
- Learn which system holds credit applications, and whether guest Wi-Fi can reach it
- Send the invite with the ask to bring one story
Day of
- Print the handout, the scenario cards (one stage per card), and sticky notes
- Set up a flip chart with four columns: Car, Wi-Fi, Financing, Parts
- Assign a note-taker
Within 1 week after
- Send a thank-you with the handout and the top 3 gaps raised
- Give the general manager an action list: gap, suggested fix, owner
- Log who came and which themes came up
- Schedule the quarterly refresher
ISO 27001:2022
- A.5.14 Information transfer
- A.5.19 Information security in supplier relationships
- A.5.21 Managing information security in the ICT supply chain
- A.5.34 Privacy and protection of PII
- A.6.8 Information security event reporting
- A.7.9 Security of assets off-premises
- A.8.21 Security of network services
- A.8.22 Segregation of networks