Brokerages and dealerships have one thing in common: large sums of customer money moving fast, and files full of Social Security numbers, driver's licenses and bank details. Criminals know it. So do regulators.
Car dealerships: you are a "financial institution"
If your dealership arranges financing or leases, the FTC Safeguards Rule (16 CFR Part 314) applies. The updated rule has been fully in force since June 9, 2023, and requires a written information security program with:
- A qualified individual who owns the program and reports to leadership at least annually
- A written risk assessment
- Access controls, encryption of customer data, and multi-factor authentication
- Oversight of vendors such as your DMS, CRM and credit-application platforms
- Staff training and a written incident response plan
Since May 13, 2024, a dealership must report to the FTC within 30 days any security event involving the unencrypted information of 500 or more customers. The FTC has said these reports will be made public.
Real estate brokerages: wire fraud is the main event
Closings are the target. A criminal gets into an agent's, title company's or client's email, waits, then sends "updated wiring instructions" days before closing. The FBI's 2025 Internet Crime Report recorded more than $275 million in reported real estate fraud losses, and more than $3 billion lost to business email compromise overall.
- Turn on multi-factor authentication for every agent's email, transaction platform and MLS login
- Put a written "we never change wiring instructions by email" notice in every transaction
- Require phone verification of wiring instructions using a number from the file, never from the email
- Have a 24-hour response plan: who calls the bank, the title company and the FBI's IC3
The Florida Information Protection Act (Fla. Stat. §501.171) requires every business holding Floridians' personal information to "take reasonable measures to protect and secure" it. After a breach, affected individuals must be notified within 30 days, and the Florida Attorney General as well when 500 or more Floridians are affected. Civil penalties can reach $500,000 per breach.
The common gaps
Shared logins at the front desk. Deal jackets with SSNs left on desks. Former employees who still have CRM access. Customer documents shared through personal email or text. No written plan, so the first hour of an incident is spent figuring out who to call. None of these need expensive technology to fix. They need a written program, clear owners and a yearly check.
Does the FTC Safeguards Rule apply to car dealerships?
Yes, to dealerships that arrange financing or leasing, which makes them financial institutions under the Gramm-Leach-Bliley Act. They need a written information security program, MFA, encryption, vendor oversight and must report qualifying breaches of 500 or more customers to the FTC within 30 days.
How can a real estate brokerage prevent wire fraud?
Use multi-factor authentication on all email and transaction systems, tell clients in writing that wiring instructions never change by email, verify instructions by phone using a known number, and keep a written response plan for a suspected compromise.