Business Email Compromise in the F&I Office: How Dealership Wire Fraud Happens

A business email compromise at a dealership can begin with one person typing a login into a fake sign-in page. From there the attacker reads your real mail, spots a payment already in motion, and quietly changes where it lands.

Last updated: November 12, 2026

Erik Nachbahr put what happened to a client into three sentences, and I haven’t shaken them since. “They get an email, they give up their multifactor authentication, that gets replayed into their 365. They get access to the email box, then it’s game on.” Erik is our president and founder. What stuck with me was the next thing he said. “That all started with them clicking on an email and putting in their credentials and not having the proper training in place.”

Notice where that story starts. Not with a broken firewall, and not with something planted on a server. It starts with a click and a password typed into the wrong place, and that was the way in.

I came up on a sales floor in the late ’90s, and my instinct is still to ask how a store actually runs. Part of the answer is email, and some of that email is about real money. So this is my take on how a wire gets redirected, what the FBI counted last year, and where I’d put speed bumps. Our cybersecurity services for dealerships page has the big picture, and the training piece has a page of its own, security awareness training for dealership employees.

How Does Business Email Compromise Work at a Dealership?

Business email compromise, or BEC, is fraud in which criminals compromise a business email account, by tricking someone or breaking in, and use it to get money sent where it shouldn’t go. The FBI’s definition in its 2025 Internet Crime Report also covers phone numbers and virtual meeting apps, so a call can be part of it.

Roughly, it goes like this.

1. An email lands with a lure. In one campaign Microsoft documented, it was an attachment telling the recipient they had a voice message. Somebody clicks.
2. The page wants a password, and then the code from their phone. CISA describes exactly this: the user submits “their username, password, as well as the 6-digit code from their mobile phone’s authenticator app” to a site made to look like the real portal.
3. Whoever built the page replays what it caught. In Microsoft’s write-up of a campaign that attempted to target more than 10,000 organizations, attackers stole the session cookie and used it to skip sign-in, even where the user had multifactor authentication turned on.
4. Then they read. They’re patient about it, too. Microsoft saw the attacker open finance-related email and attachments every few hours and search for ongoing threads where a payment fraud would be feasible.
5. The attacker replies inside a real thread about payments or invoices. In that case they also set an inbox rule to hide the other side’s replies and deleted their own messages from Sent Items, and Microsoft found the fraud could start as little as five minutes after the theft.
6. Sometimes a phone call backs it up. The FBI notes that voice cloning can be used to request a wire payment.
7. Money moves.

So where does the F&I office come in? Anywhere payment details or approvals travel by email, which at a store can include deal funding, payoffs, vendor invoices and payroll. Brandon Dorsey and I both said on our content call that it’s less about F&I in particular and more about any mailbox that touches money, plus the sign-ins behind it. F&I gets the headline because that’s where deals get financed. Accounting, I’d hate for you to read this and decide it’s somebody else’s desk. It isn’t.

What Do the FBI’s 2025 Numbers Say About BEC?

The FBI’s Internet Crime Complaint Center took in 1,008,597 complaints in 2025, with $20.877 billion in reported losses, and business email compromise accounted for $3,046,598,558 of it. Only investment fraud was bigger. Ransomware, which gets the headlines, drew a little over 3,600 complaints in the same report.

Those are straight out of the FBI’s 2025 Internet Crime Report, with a catch. The FBI calls its own ransomware total “artificially low,” since some victims never report a dollar figure and the number doesn’t normally count lost business, time or wages. Everything in that table is also only what victims reported to the FBI. Read the ransomware row as a floor.

The same report says businesses reported more than $30 million in 2025 losses to BEC scams that involved AI. It adds, fairly, that “not all are AI-enabled.” I take that as a sign the emails are getting better, and not as a reason to stop watching for the plain ones.

Ransomware tends to announce itself, because it’s built to block access to your systems until someone pays. A BEC loss can look like an ordinary Tuesday until somebody in accounting asks where the payoff went and nobody in the building can say. Neither one needs panic. Both need a plan. Make it this week.

Why Does Training Decide So Much of This?

Because in the case Erik described, step one was a person typing a password into the wrong page. Training is aimed at that exact moment. It works early. It’s the layer that comes before the attacker is anywhere near the account.

Erik was blunt about where it sits. Blunt, and right. “It’s not an IT control or something we can do, it’s a process.” The way I read it, that’s the habit of stopping before you click and checking before you pay. You can’t install a habit. It’s a habit problem.

What worries me is what Brandon hears on his compliance calls. Dealers tell him security training has “completely fallen off,” and he calls the trend “going down big time.” That’s his read from those calls, not a survey. I’d still take it seriously.

The rule hasn’t gone anywhere. For what it’s worth. For a dealership the FTC Safeguards Rule covers, 16 CFR 314.4 requires multi-factor authentication “for any individual accessing any information system,” unless the Qualified Individual has approved reasonably equivalent or more secure controls in writing. It also requires security awareness training “updated as necessary to reflect risks identified by the risk assessment.” Both belong on the same page of your Safeguards Rule checklist.

Multifactor authentication isn’t a finish line. Not by itself. CISA says any form of it beats none, but some forms can be phished, and it calls phishing-resistant MFA the gold standard. A code you can type into a fake page is a code you can hand to the wrong person.

Our security awareness training is customized and created specifically for dealership employees, and we have a team that makes sure it actually gets done, because a course nobody finishes doesn’t protect anybody. Ours is dealership-specific. That’s not a slogan. It’s the point.

Which Layers Slow Wire Fraud Down?

No single control stops business email compromise. The six below work together: training so fewer people hand over a login, a payment process that doesn’t trust email alone, limits on what one stolen login can reach, and security monitoring that watches for the attacker. How much damage an attacker does depends on how fast they move.

• Training. Someone who has seen the fake page once has a better shot at spotting the next.
• A callback rule for payment changes. Any request to change bank details gets confirmed by calling a number you already had on file. Never the one in the email. The FBI’s own tip is to “use secondary channels and/or two-factor authentication to verify requests for changes in account information” (IC3, 2024).
• Two people on every outgoing wire above a number you pick, where one person prepares it and a second approves it, and the second one actually reads what’s in front of them.
• Privileged access control. Admin rights stay with as few accounts as possible, and those accounts get extra checks, so one stolen login reaches less.
• Multifactor authentication on every account that touches email or money, caveat above included.
• Security monitoring that doesn’t sleep. Our security support runs 24/7: live, US-based analysts monitor your systems and step in the moment they see signs of an attack. It’s a monitoring team, not a phone line.

I keep landing on training first because the attacker’s speed is the variable. A person who stops and checks costs them time, and the rest of that list is there to buy you more.

If a wire has already gone out, don’t wait for a meeting. The FBI’s guidance in that report is to contact your financial institution right away and request a recall of the funds, along with any indemnification documents the bank needs, then file a complaint at ic3.gov whatever the amount, with the full transaction details. In 2025, the FBI’s Financial Fraud Kill Chain process froze $507,042,623 across 3,574 domestic incidents. Report it fast. We cover the email side in our guide to email security for dealerships.

What About the Phone Calls?

The call is the other half of the same fraud. It goes both ways. Someone phones your finance office posing as a vendor, or someone phones a help desk posing as one of your employees, and the fix is the same either time, because you verify the person through something you already have on record and not something they hand you on the call.

That’s why, since November 17, 2023, we verify the identity of every person who calls our help desk for support. The preferred check is a one-time code sent to the email address or mobile number already on the contact’s record, never to details the caller gives on the call. A caller who can’t be verified gets no support or access until they are. Rex Marchant, our Vice President of Service, wrote up the reasoning in why we verify every dealership caller.

It can feel awkward the first time you do it. Do it anyway.

Things Dealers Ask Me About Wire Fraud

Ask What You’re Not Doing

“Whenever I feel like things aren’t going the way I want them, I always ask myself what am I not doing?” That’s my line. It fits this problem. Often the answer is small. Maybe there’s no written callback rule. Maybe nobody’s sat the staff down in a while.

We work with 2,000-plus dealerships, and we manage the technology so they can sell and service cars and heavy trucks. If you want a second set of eyes on where you stand, the complimentary IT and cybersecurity assessment looks at your security posture, your technology setup, your vendor spend, and where you are on the FTC Safeguards Rule. The findings come back in writing.

Start with one rule. Nobody changes where the money goes on the strength of an email.