Every financed deal leaves a trail through the F&I office: a credit application, a driver's license, Social Security number, income, bank details and sometimes a co-buyer's information too. Multiply that by every deal for years and the F&I office holds more sensitive personal data than any other room in the building.
It's also the room where speed matters most, which is why shortcuts creep in. Here's how to close them without slowing anyone down.
1. One person, one login
Shared F&I logins are the most common gap we find. They make it impossible to know who did what, and when one manager leaves, the password usually doesn't change. Give every F&I manager their own login to the DMS, the lender portals and the computer, and turn off accounts the day someone leaves.
2. Multi-factor authentication everywhere customer data lives
The DMS, every lender and credit portal, email and remote access. The Safeguards Rule requires MFA for anyone accessing customer information. App-based approval on a phone takes a few seconds and stops most stolen-password attacks cold.
3. Scanned deal jackets go somewhere locked
The usual setup: the copier scans to a shared folder that everyone in the building can open. Instead, scan straight into the DMS or to a folder only F&I and the office can reach, with older files archived and encrypted. Then clean out the old shared folder. It's usually full.
4. Encrypt the computers
If an F&I laptop or PC walks out the door, encryption is the difference between a lost device and a reportable breach. Every modern business version of Windows can do this; it just has to be turned on and managed.
5. Keep F&I off the customer Wi-Fi
F&I computers, the customer Wi-Fi in the lounge and the shop equipment should be on separate networks that can't see each other. If a customer's infected laptop joins your Wi-Fi, it should have no path to a computer holding credit applications. More on this in dealership Wi-Fi that reaches the service bays.
6. Watch for the warning signs
Endpoint detection and response on every F&I computer, email filtering that catches fake lender messages, and someone actually watching the alerts around the clock. Phishing emails pretending to be from a lender or the DMS provider are aimed squarely at F&I.
7. Paper still counts
Locked drawers or cabinets for paper deal files, a shredding service with a certificate, and screens that lock after a few minutes. The Safeguards Rule protects customer information in any form, not just digital.
What this has to do with the FTC
Since the amended Safeguards Rule took full effect in June 2023, dealerships that arrange financing need a written information security program covering exactly these controls. Since May 2024, a breach affecting 500 or more consumers has to be reported to the FTC within 30 days. A locked-down F&I office is the single biggest step toward both. The full rule, explained.
How we help
We support franchise dealerships across Sarasota, Manatee and Charlotte counties, and the F&I office is the first thing we lock down. If you'd like a straight answer on where yours stands, book a free dealership IT assessment or a 15-minute call.
