Artificial intelligence may be the greatest productivity tool to reach automobile retail in a generation. Unfortunately, criminals have subscriptions, too.

While dealerships are exploring AI for marketing, lead management, finance-and-insurance, fixed operations, accounting, training and compliance, fraudsters are using the same technology for a less wholesome purpose: stealing from dealers.

Your dealer clients are attractive targets. They have expensive inventory. They move large amounts of money. And they possess enormous quantities of valuable consumer data.

Generative AI and F&I Don’t Mix

Start with fake documents. For years, experienced dealership personnel learned to spot questionable proof-of-income documents. Maybe the deductions did not make sense. Perhaps year-to-date income did not reconcile with the pay period. Maybe the fonts changed halfway across the page.

Generative AI changes that. Fraudsters can now produce extraordinarily convincing pay stubs, bank statements, insurance documents and other financial records. Documents that once required considerable skill to fabricate can increasingly be produced quickly and at scale.

High-quality counterfeit driver’s licenses have become more difficult for an unassisted human being to distinguish from genuine documents.

And then there are synthetic identities — combinations of real and fabricated information that create a person who, for practical purposes, does not exist. AI and automation dramatically reduce the cost, expertise and time required to create and manage them.

The Deepfake Video Call

And then things get genuinely interesting. Deepfakes increasingly allow criminals to impersonate real people through voice and video. Consider the implications inside a dealership group.

The controller receives a video call apparently involving a senior executive. The executive needs money transferred immediately to complete a confidential transaction. His face looks right. His voice sounds right. He knows details about the company. Perhaps several apparently familiar people even participate in the call.

But at some point, “But I saw him on video” ceases to be adequate authentication.

The proper response is procedural rather than technological. For significant money transfers, independently verify the instruction through a second trusted channel.

Hang up. Call the executive at a previously verified telephone number. Require approval from another authorized person. Use multifactor authentication. The 30 seconds consumed by verification may be the most profitable 30 seconds anyone at the dealership spends that week.

That’s Not My Website

A criminal can imitate a dealership’s website and attract consumers who believe they are dealing with the actual store, inviting them to complete a credit application, upload identification or make a deposit. Now the criminal has money, identity information or both. The consumer, meanwhile, may blame the real dealership.

This is why cybersecurity can no longer be treated as the IT department’s mysterious hobby. Federal regulations already require automobile dealers engaged in covered financial activities to maintain appropriate safeguards for customer information. AI does not eliminate those obligations. It makes them more urgent.

Protocols and Employee Training

Revisit each dealership’s information security programs and risk assessments with AI in mind:

• How are employees using generative AI?
• Which vendors receive customer information?
• Can dealership data be used to train an outside vendor’s AI model?
• Which authentication controls protect connected systems?
• What happens when an employee receives an unusual payment instruction?
• Are employees being trained to recognize AI-enabled fraud?

That last question matters. We train employees not to click suspicious links because phishing works. AI makes phishing better. Messages can be personalized, grammatically perfect and tailored to information collected from public sources.

The old Nigerian prince appears to have hired an editor.

Training must therefore evolve from “look for obvious mistakes” to “follow the verification procedure even when everything looks authentic.” Do not trust an email because it looks legitimate. Do not trust a voice because it sounds familiar. Do not trust video merely because you can see the person. Do not trust a document simply because the math works.

Verify.

Artificial intelligence is neither good nor evil. It is leverage. It makes capable people more capable, productive people more productive and, regrettably, dishonest people more efficient.

Agents and dealers cannot prevent criminals from using AI. They can make the dealership much harder to fool — and in fraud prevention, being the harder target has always been a pretty good place to start.