Is your email safe?

Here is one of the costliest frauds run against a dealership, and it involves breaking into nothing at all.

Someone emails the finance office from a supplier the dealership already trusts. A change of bank details on an invoice. An attachment. A request that looks routine because it looks familiar.

No system is compromised. The message is simply forged, and it is delivered because nothing told the receiving mail server to refuse it.

Only the vendor can stop mail that forges its exact domain. The domain owner publishes one public instruction — a DMARC policy — asking every mail server that checks it to refuse those messages, and most large providers do check. It costs nothing. It requires no software. And the dealership cannot publish it on the vendor’s behalf.

Email authentication is one of the nine signals in the study, and it is the one with the shortest distance between finding out and fixing it. We measured it across 147 dealership software brands, and those figures are on the study page today.

If you sell software to dealers: check your own domain before somebody else does.

The full study publishes in October 2026.