While AI-powered fraud is becoming easier to commit and harder to detect in dealership F&I, AI tools can help dealers identify it. But dealers that fail to use readily available defenses could be found negligent if attacked. A documented compliance program, including written policies, training, and audits, can protect dealers from punitive damages. On today’s episode of Training Camp, Jim Ganther, Chief Executive Officer at Mosaic Compliance Services, joins host Adam Marburger to discuss the legal risks of AI-driven fraud and how dealers can protect themselves.
AI-powered fraud
According to Ganther, fraudulent methods that dealers already know about have become more convincing and easier to produce at scale. He notes that while fake proof of income was once easy to spot, AI-generated documents now carry real company logos and penny-perfect tax and deduction math, in which he said those documents will fool most dealers.
Ganther said synthetic identities are another area of concern. He recalled finding websites selling keys to generate them at scale for $500 for 30 days or $750 for 90 days. Spoofed dealer websites can also divert leads and capture credit applications.
“The fact of the matter is you’re going to have to learn F&I utilities and tools as if they are products.”
AI-based tools can also help counter these threats. Document authentication, identity validation, and proof-of-life services can detect forged documents and deepfake videos that were injected rather than captured in real time. Mosaic uses document authentication, and Ganther said dealers will likely be expected to use these tools. Ganther recommends that F&I agents learn to use them just as they learned about new products, since dealers will turn to agents for guidance on how AI is being used in the F&I office.
Dealers held liable for skipping available AI defenses
A dealer hit by an AI-enhanced attack could be found negligent for failing to use available AI defenses, Ganther said. He pointed to the 1932 T.J. Hooper case as the governing federal precedent. A tugboat company lost two tugs and a coal barge in a storm off Delaware. The Second Circuit held it liable because four other tugs on the route carried an affordable wireless receiver, heard the storm warning, and took shelter.
The same logic applies to AI-enhanced phishing. A court could find that a dealer lacking AI-based defenses failed to meet its duty of reasonable care, supporting a negligence claim. “The duty of care has to elevate to meet the risk it’s defending against,” Ganther said.
Written policy, training and audits limit a dealer’s exposure
A documented, good-faith compliance program can protect a dealer from punitive damages, Ganther said. The defense comes from the Kolstad case, which requires a written policy, annual employee acknowledgment, training and audits, with correction where needed. A dealer who can prove those steps may still owe actual damages, which Ganther said are typically close to zero.
Ganther cited a client dealership sued by a professional plaintiff over 12 unsolicited text messages sent in 12 months, with $2,500 sought for each message. He said no lawsuit has succeeded against a dealer his company protects in this way.
For dealers, the takeaway is to use both approaches. AI tools defend against new threats, and written policy, training and audit records defend against liability. “You need the AI tools to defend yourself, and you’re going to need the good old-fashioned policy training and audit activity defense as well,” he said.
