Managed Cybersecurity
Email Security for Dealerships: Stop Wire Fraud Before the Money Moves
Fake controllers, hijacked vendor accounts and invoices nobody ordered get caught at the inbox, not after the wire clears.
Email security for dealerships protects the mailboxes that move money, from the controller’s to accounting’s and the F&I office’s, against wire fraud, impersonation and fake vendor invoices. Helion Technologies runs it inside managed cybersecurity, backed by 24/7 security support from a live, US-based team.
Last updated: October 26, 2026
The Email That Costs a Dealership Money Looks Routine
It usually goes like this. A parts supplier the store has paid for years writes to accounting, inside the same thread as last month’s invoice, to say their bank changed and the next payment should go to the new account. The email really did come from the supplier. That’s the trick. Someone had been sitting in their mailbox for weeks, reading invoices and waiting for a big one. The FBI’s 2025 Internet Crime Report counted $3,046,598,558 in business email compromise losses across 24,768 complaints, and a dealership accounting office, with floor plan payoffs, vendor bills and deal funding moving every day, is exactly who those messages get written for.
Email security is the part of cybersecurity for dealerships that sits between those messages and the person who can send a wire. Filtering is part of it. So are the sign-in rules on every mailbox, the alerts our analysts watch when an account starts acting strange, and a payment process that doesn’t trust email at all. Teaching your staff is its own service, security awareness training, and running the tenant is managed Microsoft 365. This page is about the mailbox and the money.
A spam filter looks for bad email. Wire fraud usually sends good email.
How Wire Fraud Reaches a Dealership’s Accounting Office
Controller impersonation works because of how a store runs. The controller approves payments, accounting processes them, and both are slammed at month end when floor plan curtailments, vendor bills and deal funding all land at once. So a message from the controller asking someone to get a wire out before the bank’s cutoff doesn’t feel strange at 3:40 on a Friday. It feels like Friday. Sometimes the address is a lookalike with one letter changed, and sometimes it’s the controller’s real account, opened with a password somebody phished the week before.
Vendor invoice fraud is the same play from the outside. The attacker gets into a supplier’s mailbox, maybe a parts vendor, a body shop or the marketing agency, and replies inside a real thread. Nothing in that email is fake except the bank account. Not one thing. That’s why we never ask a filter to carry this alone. The rule that holds up is simple, and it’s that bank details never change on the strength of an email, and every change gets a call back to the number already on file.
Once a wire is out, the clock is running. Call your bank first and ask for a recall. Then file at ic3.gov with every transaction detail, whatever the amount. The IC3’s Recovery Asset Team worked 3,900 fraudulent transfer incidents in 2025 and froze $679,013,183, which was 58% of what the thieves tried to move, but it can only freeze money somebody tells it about. Our incident response team handles the mailbox side while you’re on the phone with the bank.
Real email. Fake account.
The sender is real
Vendor fraud often comes from the supplier’s actual mailbox. It’s in a thread your store started. Nothing looks off.
Check the request, not the name.
One letter off
A lookalike domain swaps one letter or adds a word. Read on a phone at the service drive, it passes.
Software is better at this than people.
Our own phones too
We verify everyone who calls our help desk for support, and we have since November 17, 2023. A voice you know isn’t proof.
Same rule for email.
The Team Watching Your Dealership’s Email
That verification rule earns its keep. A vendor approved for one dealership’s accounting work let several of its own people share a single login, and two of them called our help desk pretending to be dealership employees. Both were refused. Neither got in. We told the dealership and handed over the call recordings, and the dealership replaced the vendor. Our help desk is open whenever dealers are open, 7 days a week, and security support runs 24/7.
Managed Cybersecurity
What Email Security for Dealerships Covers, One Fake Email at a Time
Take one fraudulent payment request and read it the way the attacker wrote it. Every part of it leans on a weak spot, and every weak spot has a control. Here’s what we put against each line, for every mailbox at every rooftop you run. Six lines. Six fixes.
Think someone’s already in?
Our Microsoft 365 breach assessment is a one-time hunt for signs that someone is already reading your mail.
One fake wire request Six parts, and the control behind each one
From The sender, real or borrowed
Every message gets checked before delivery, including where it actually came from and whether the domain is a near copy of one your store deals with. Mail from outside the dealership is marked as outside, too. That one sounds small, and it isn’t, because “the controller” writing from a free email account suddenly looks like what it is.
Outside mail looks outside.
Domain Your own name, used against you
SPF, DKIM and DMARC are three records that tell other mail servers who’s allowed to send as your domain. Without them, anyone can send mail that says it’s from your store, to your customers or your lender. Since February 1, 2024, Google’s sender rules have required all three from anyone sending more than 5,000 messages a day to Gmail, and a dealership’s marketing mail can get there. We check those records during the assessment and fix what’s missing.
Nobody else sends as you.
Link The sign-in page that isn’t real
Links and attachments get looked at before anyone can click them. Some still get clicked. So the real protection is multi-factor authentication on every mailbox, which the FTC Safeguards Rule already requires for anyone accessing an information system that holds customer information. With it switched on, a stolen password alone doesn’t open the controller’s inbox. Our post on the right way to do MFA covers the managers who hate the prompts.
A password alone shouldn’t open it.
Mailbox An account that starts acting strange
An attacker who gets in tends to stay quiet. They’re patient. They sign in from places your staff never work, add a rule that hides the vendor’s replies, and read invoices until a big payment comes along. Those are signs of an attack. Live, US-based analysts monitor your systems 24/7 and step in the moment they see them, which is the work behind our managed detection and response.
Caught while it’s still quiet.
Ask New bank details, due today
No filter fixes the ask itself. A written rule does. Bank details change only after a call back to the number already on file, a second person signs off on any change, and there’s no exception for an email that says it’s from the GM. We help put that rule into your Safeguards program, and our training teaches the controller’s office to use it without feeling rude.
Bank details change by phone.
After When one gets through anyway
Plan for the bad day while it’s still a normal one. The Safeguards Rule asks for a written incident response plan, and for email fraud that plan names who calls the bank for a recall, who files with the IC3, whose passwords get reset and who tells the vendor. Our incident response plan template gives you the outline.
Know who calls the bank.
Where filters stop
Five Fake Emails a Dealership Gets, and What Actually Stops Them
Built-in filtering catches a lot of junk, and we’d never tell a dealer to switch it off. It’s the messages with nothing technically wrong in them that cost money. That’s the gap. Here’s why each one slips past a filter, and what we put in its way instead.
| The email | Why a filter lets it through | What stops it |
|---|---|---|
| New bank details from a real vendor | It comes from the vendor’s own account, in a real thread, with no bad link in it | A call back to the number on file before any bank detail changes |
| The controller asking for a wire before cutoff | A lookalike domain or a borrowed real account reads as normal mail | Outside-sender marking, lookalike checks and a second approver on every wire |
| A message that says it’s from your own domain | Without DMARC, the receiving server has no way to tell it’s forged | SPF, DKIM and DMARC set on your domain |
| A Microsoft 365 sign-in page behind a link | A brand-new phishing page isn’t on anyone’s block list yet | Multi-factor authentication, plus analysts watching for strange sign-ins |
| A parts invoice nobody ordered | The PDF is clean. The request is the scam | Matching it to a repair order before anyone pays, which the training teaches |
For the staff side, our anatomy of a phishing attack follows one email from inbox to breach, and the W-2 scam is the payroll version accounting sees every tax season. Tools help. The payment rule matters more.
How Email Security for Dealerships Starts
-
1
Ask for the assessment
Fill in the short form for our complimentary IT and cybersecurity assessment. It costs nothing, and you don’t need to be shopping for a new provider.
-
2
We look at the mailboxes
An engineer reviews your email protection, sign-ins and multi-factor authentication, admin rights and your domain’s mail records, on-site or remotely.
-
3
Findings arrive in writing
You see what’s protected, what’s open and where a fake payment request would most likely land at your stores.
-
4
You decide what’s next
Fix it in-house, or hand us the work as part of managed cybersecurity. Onboarding starts within weeks of signing.
Common Questions
Wondering what’s getting through?
Our complimentary IT and cybersecurity assessment looks at your email protection and writes up what it finds. Already know what you need? Get a price quote.
What does email security include for a dealership?
How does wire fraud happen at a car dealership?
A fake wire already went out. What do we do?
Doesn’t Microsoft 365 already filter our email?
Does the FTC Safeguards Rule cover email security?
Our IT person already handles email. Do we need this?
Bank details change by phone. We’ll help with everything else in the inbox.
Request a Complimentary Assessment →