Cybercrime Is Getting Smarter—Here’s How Your Dealership Can Stay One Step Ahead

Today’s hacker gangs like ShinyHunters and Scattered Spider are organized, well-funded, and disturbingly good at impersonating your staff, vendors, and even your customers.

These groups aren’t just poking around for fun. They’re targeting dealerships with social engineering, voice phishing (aka “vishing”), and credential theft to access sensitive data, loyalty programs, and financial systems. And they’re not shy about using AI to do it. In many instances, their techniques do not involve malware or other aspects of network intrusion, so your end point detection systems are not effective in identifying these threats. So how do you protect your dealership from becoming their next headline?

5 Tactics to Keep Your Dealership Off Their Radar:

1. Train Your Team to Spot Vishing and Deepfakes

Scattered Spider is infamous for calling employees pretending to be IT or HR. With AI-generated voices and spoofed caller IDs, it’s disturbingly convincing.

👉 Tip: Run quarterly role-play drills. Teach staff to verify requests through internal channels—never act on urgent calls alone. Consider adding dealership verification words or phrases that you only share in voice communications – think challenge and password if you are a military member!

2. Lock Down Your Customer Service Portals

ShinyHunters love customer service platforms—they’re a goldmine of personal data and often lack strong security.

👉 Tip: Audit your CRM and support tools. Enable multi-factor authentication (MFA) and restrict password resets to verified channels. Consider implementing voice verification procedures using known and trusted voice communication systems before executing any request or providing login credentials.

3. Monitor for Brand Spoofing and Fake Domains

These gangs register domains that look eerily similar to yours (e.g., ticket-yourdealership[.]com) to phish employees and customers.

👉 Tip: Use domain monitoring tools to catch impersonators early. Consider DMARC and SPF records to protect your email reputation.

4. Don’t Rely on Passwords Alone

Credential stuffing is a favorite tactic. If one vendor gets breached, your reused password could be next.

👉 Tip: Enforce strong, unique passwords and MFA across all dealership systems. Bonus points for password managers. Update your internal written policies on password security and socialize with all staff.

5. Vet Your Vendors Like You’d Vet a Used Car

If your vendors aren’t securing their platforms, you’re exposed.

👉 Tip: Ask vendors how they protect against social engineering, what their breach response plan looks like, and whether they meet FTC Safeguards Rule requirements. Request security attestations and use the tools in the A2Safe Hub “Manage my Vendor” function to post and manage third-party due diligence.
Want to See How These Gangs Operate?

Check out these short reads that show just how sophisticated these groups have become:

Cybersecurity isn’t just an IT problem—it’s a business continuity issue. Dealerships that treat it like a strategic priority will build trust, resilience, and a competitive edge. The bad guys are evolving. So should we. Your partners at Accelerate2Compliance can help you build a culture of security in your dealership and help your team to be less vulnerable to these sophisticated attackers.
Contact us [email protected] or call (844) 637-5511 for further information.

Matt Vatter

Chief Compliance Officer, Accelerate2Compliance