AI Payments at Car Dealerships: Who Controls the Transaction

AI payments at a car dealership are AI tools that ask customers for money, such as sending a text-to-pay link or following up on an open balance. The store stays in control when the AI requests payment but never takes card numbers or approves charges.

Last updated: October 28, 2026

The payment link isn’t the risky part. The conversation around it is.

Text to pay has been on the service drive for years. It works. The advisor closes out the repair order, the customer gets a link, they pay from work or from the waiting room, and the car is ready when they walk up to the counter. Nobody on the floor misses chasing people down at the cashier window. What’s new? Who sends the link. More and more often it’s an AI agent, and that agent also answers the customer’s questions, reminds them about the balance, and decides what to say when they push back on the bill.

Cox Automotive’s AI in Auto Retail Tracker, released in August 2026, found that 82% of dealers use AI today, and coordinating customer follow-up is tied for the top use at 40%. Payment follow-up is follow-up. So for the office manager, the controller, and the CFO, the question isn’t whether AI will touch the store’s money. At plenty of stores it already does. The question is who controls the transaction once it does.

I’ve worked the service drive, done finance support at a DMS company, and spent about four years on Tekion’s Learning & Development team before I joined Helion Technologies. The money side of a store has the least patience for surprises. Ask any controller. Small setup details turn into real dollars there faster than anywhere else. This post sits under our managed AI services for dealerships, because the rules for an AI that touches payments belong in the same plan as every other AI tool your store runs.

Asking for Money and Handling Money Are Two Different Jobs

Most of the confusion comes from one label covering two very different jobs.

The first job is the request. The AI sends a secure link from your payment processor, tells the customer the car is ready and the balance is $412.60, and answers “can I pay part of it now?” with whatever your policy says. The customer types their card into the processor’s own page on their phone, from the waiting room or the office or wherever they happen to be standing, and the AI never sees the number. It only learns that the payment went through. That’s it.

The second job is handling, and it’s a different animal. Here the AI collects the card number and security code over a voice call, keeps a card on file for next time, knocks a little off the bill to close it out, or issues a refund because the customer sounded upset. Most stores never sat down and decided to turn those things on. They came bundled with the feature, and nobody read that far into the setup screen.

If your AI only does the first three rows, you’re in decent shape. Rows four and five are where stores get hurt. Every time.

Know which rows yours does.

Keep Card Numbers Out of the AI, the Transcript, and the Recording

This is the part I’d tape to the office wall. The PCI Security Standards Council’s own guide to storing card data says sensitive authentication data must never be stored after authorization, even if it’s encrypted, and that includes the three- or four-digit security code printed on the card. Its guidance on telephone payments goes further and says digital audio recordings can’t be used to keep those codes after authorization if the recording can be searched.

Now think about what an AI voice or chat agent produces. A transcript of every word. Usually a recording. Often a summary that drops into your CRM. If a customer reads their card number and security code to the agent, all three can end up holding card data, in systems nobody set up to protect it.

Here’s the easier way in. The data storage guide also notes that PCI DSS doesn’t apply where card numbers aren’t stored, processed, or transmitted. So the number your AI never hears? Nobody has to guard it.

Every service drive I’ve worked had a key drop box by the door. A customer shows up at 7 p.m., seals the keys in an envelope, slides it through the slot, and goes home. Nobody asks the porter to wait out there in the dark. Your processor’s payment page is the payment version of that slot, and the AI should send people to it, not stand in for it.

When I built training, the lesson that stuck was always the one people practiced. Hands-on experience and repetition make a world of difference. Same here. Get the vendor on a test call and have someone from your office start reading a test card number to the agent. Does it cut them off and text a link? Then pull the transcript and the recording from that call and go looking for the number. If it’s sitting there in plain text, you found the problem before a customer did.

Two more checks while you’re at it. Masking has to happen by itself, since an employee hitting pause at exactly the right second isn’t how a Saturday on the service drive goes. And the AI doesn’t keep cards on file for anybody, regulars included.

Our AI phone agent security and consent checklist has the deeper rules on recordings and consent. The payment rule fits on a sticky note, though.

Card numbers stay out of the AI.

Decide What the AI May Do on Its Own

Settle this before the vendor’s setup call. Once that call starts, the defaults win.

Security people have a name for an AI that can do more than its job needs. OWASP, which publishes a widely used list of AI application risks, calls it excessive agency: too many functions, too many permissions, or too much independence. A payment agent that can only send links can’t be talked into refunding anybody. One that can issue credits can be. By an angry customer, or by someone who worked out what to type.

Here’s the short list I’d want settled first:

• Which actions it takes alone. For most stores that’s sending links, sending reminders, and confirming that a payment posted.
• A dollar ceiling. Pick the number your controller would let a brand-new cashier handle without asking anyone. Over that, a person steps in.
• What it never does: refunds, discounts, waived fees, payment plans, or any change to what’s on the repair order.
• How hard it pushes. Two reminders and then a call from a real person beats six texts in three days.
• Quiet hours for money talk, even if the agent answers general questions all night.

Time is money in this business. So is the goodwill of a customer who feels hounded over a $90 balance on an oil change.

Small list. Written down. Signed by the controller.

The Handoff: Yes, No, and “That’s Not My Bill”

The moment a customer says something the AI isn’t allowed to settle, a named person should own it within a time your store sets. Not a ticket that sits in a queue until Monday.

Sometimes the customer says yes, just not the way the AI expected. Half today and half on Friday, say. The agent tells them a person will call and routes it to the office. It doesn’t invent a payment plan to close the conversation. Ever.

A dispute goes back to the service advisor who wrote the repair order. I wrote service early in my career, and the advisor usually knows exactly why that line is on there. One short phone call from them settles more than a string of texts from a bot ever will. Faster, too.

Then there’s the customer who says “I never had my car serviced there.” Stop everything. That’s either a wrong number in your records or someone using your store’s name to send fake payment texts, and the customer who reports it is doing you a favor. Your accounting office already deals with the email version of this scam, and our guide to stopping wire fraud at dealerships walks through how those fakes reach the office.

One more control. People skip it. Before the AI talks about anyone’s balance, it should confirm it’s talking to the customer on the repair order, using details your store already has on file. A neighbor who picked up the wrong phone doesn’t need to hear what the brake job cost.

The AI starts the conversation. People finish the hard ones.

The Paper Trail Accounting Will Want

A payment doesn’t stop at the cashier window. It keeps going. It posts against the repair order in the DMS, closes out in accounting, and shows up in a bank deposit somebody reconciles the next morning, so when an AI is part of that chain, every step needs a record that the controller can actually find without calling the vendor.

I learned how much rides on the boring settings during a multi-rooftop dealer group’s move from CDK to Tekion, more than 30 stores in all. In the daily war rooms, bank setups sat on the list right next to permissions, forms, and hardware. Nobody brags about that kind of work. It’s the work that makes the money land where it should.

For an AI that asks for payment, the log should show every link it sent, to which phone number, for which repair order and amount. Every reminder too. Each handoff to a person gets a line, with who picked it up and when. And every payment confirmation from your processor should match back to its repair order, so the office can tie the AI’s conversation to the deposit.

If your controller can’t pull that for any repair order in a couple of minutes, the setup isn’t finished. Not yet.

If it isn’t logged, it didn’t happen. Accounting already knows that.

Who Owns the Payment AI at Your Store

Somebody has to. Usually it’s the controller or the office manager who runs it day to day, with the CFO or dealer principal signing off on the rules before the AI sends its very first link.

The ownership matters because the store is on the hook for what the AI says. When the FTC announced its 2024 crackdown on deceptive AI claims and schemes, then-Chair Lina Khan put it plainly: “there is no AI exemption from the laws on the books.” If the AI tells a customer something your cashier couldn’t say, your store said it. Simple as that.

Before anything goes live, sit the vendor down with these:

• Where does a card number go if a customer types it into the chat?
• Show me the transcript and the recording from a test payment call.
• Which actions can the agent take without a person, and can we switch each one off?
• What does the log export look like, and can accounting pull it without calling you?
• Who at your company can read our customers’ conversations?

Then ask yourselves who gets the call when the AI does something nobody expected. Put a name next to that answer.

We don’t sell a payment bot, and I’m not going to tell you which one to buy. What we do for the 2,000-plus dealerships we support is help the store set the rules, limit what each AI tool can reach, and keep the network and accounts underneath it secure. Our guide to AI governance for dealerships covers the bigger picture, from shadow AI to who approves new tools.

One owner. Written rules. That’s the system.

What Office Managers Ask Us

Start With the Link You Already Send

AI is here and it isn’t leaving. I’d rather see stores set it up for success now than spend a year cleaning up after it.

So start small. Pull up the text-to-pay message your service drive sends today, check where the link goes, and write down the three things the AI is allowed to do with it. Then hand that list to the people on the floor who answer the phone when a customer is upset about a charge, because they’ll spot the gap faster than anyone in a meeting room. Writing those rules down is the real work, and the AI is the easy part. If you’d like help looking at how your AI tools, accounts, and network fit together, start with our complimentary IT and cybersecurity assessment.