Cyber defences in the age of digital car finance

“Motor finance providers use brokers, like mortgage and asset finance providers, where additional considerations need to be made to counteract the threat of cybercrime,” explains Phillips.

“Perhaps unique to the motor industry are the dealerships and independent showrooms in the motor trade. Away from more secure office locations or retail spaces, these showrooms now let the dealer and the customer complete motor finance agreements that use automated underwriting services and e-signature processes to capture, credit score and obtain finance on behalf of customers.”

Many dealers have full access to customer data, which means preventing Personal Identifiable Information data theft is as important as stopping external threats from hacking remote servers. This risk is exacerbated by the presence of third parties, which can be vulnerable to threats such as devices used to access services becoming infected with keystroke logging, remote access or ransomware threats.

One aspect of motor finance that separates it from other financial products is that it is secured against a high-value, mobile asset.

Sums of money can be larger than that of a personal unsecured loan, particularly for high-end cars, caravans, vans and lorries.

This means that any risk assessment for fraud or other criminal activity must take into account that while customer data might look legitimate, the vehicle itself may not even exist, has been recently scrapped or is being used to take out multiple simultaneous agreements with different providers.

Providers must not just secure networks, online portals and databases, but also ensure they are not being used as gateways for other forms of cybercrime.

As solutions improve, the challenges are also developing at a rapid pace, and where larger banking providers might once have been a prime target, as they do better at securing themselves criminals are moving their attention elsewhere.

“Cyber security has become an arms race. With the top-tier banking providers now spending vast amounts of time and effort securing their sites, attackers are turning their attention to smaller financial service providers, whom they think will be more relaxed and less secure,” Phillips points out.

“While accessing a motor finance agreement portal does not give a hacker direct control of a current or savings account, they are likely to obtain PII and banking data, such as bank account or card details stored for making repayments. It is critical then that motor finance providers of any size put cyber security at the top of their agenda.” 

Phillips argues that the benchmarks services should be measuring up to are ISO 27001 or PCI DSS standards to give the level of comfort they need, particularly among small to medium enterprises without the means to build and maintain their own secure solutions with small armies of development and operations teams.

“They must rely on outsourcing the development and support of such solutions to third parties, and so put their reliance on these organisations to build, host and support these services in a way that gives them the best chance of keeping cyber threats at bay,” Phillips says.

“Providers hold both PII and banking data on their customers, both of which are exactly what cybercriminals are looking to get their hands on, so this must be secured from both direct server-side attacks as well as attacks via front-end platforms such as dealer portals and customer banking apps.”

As self-servicing is growing rapidly, there is also the threat of portal access through sheer brute force or the social engineering of usernames and passwords.

The technology continues to move forward at incredible speed. The introduction of products like smart leasing may open the door to new crimes such as drive-by hacking to steal payment data, or car theft, not to steal the car itself, but the data on board it.

“The motor industry is going through of period of high innovation, with both the evolution of electric vehicles and the connectivity vehicles have to the internet,” Phillips points out.

“Competition for sales is just as high as it has ever been, with the price for new vehicles under pressure while at the same time escalating due to increasing global inflation and escalating manufacturing costs. Makers are looking for alternative ways to get their vehicles out into the market, with wider options for leasing and pay-to-drive becoming more attractive.”

Owning a vehicle outright is no longer the default option. Manufacturers are looking at the rise of pay-to-use bicycles or e-scooters and want to scale up that model for motor vehicles. The opportunities are rife - for businesses and criminals alike.

“This intrinsic link between the asset and the finance model is leading to manufacturers looking at embedding finance payments within the vehicle itself,” Phillips explains. “But if a vehicle is to be linked with PII and payment data then it becomes an attack surface, with the potential for cyber criminals to invent new ways to hack connected vehicles such as downloading finance data while in the garage or come up with drive-by wireless hacking.

“The arms race is only set to intensify in the future. They are all under the watchful eye of the FCA, so a serious breach has the potential to be ruinous, with fines often large enough to seriously damage their ability to continue as a viable business.”