#106 - MM - Desperate Times Cause Desperate Actions
28 Jan 2026 · 4 min
Podcast episode (#106) — a Monday-minute conversation between Jeff Watson and Luke about a payroll phishing/cloned-email scam discovered during early COVID-19. A cloned employee email led the comptroller to update bank information, diverting two payrolls before detection. The hosts discuss how remote work and reduced in-person controls increased vulnerability and offer practical recommendations: enforce payroll-change procedures, strengthen email/privacy/security (spam/antivirus/firewalls), improve cash/test-drive controls, and deploy better cameras/lighting. The tone is cautionary and advisory.
Chapters
Hey.
Hey, Luke.
Happy Monday to you, buddy. Looks like things are moving. We're seeing a lot more traffic on the lot. People are running around. Stuff's happening. Good and bad.
Yeah, good and bad.
What's going on, man? Gotta watch out. Cover your tail, keep your head on a swivel.
There's scams out there. And unfortunately, bad times in our country bring out more bad people. Right? Desperate people maybe. And maybe people realize that maybe you don't have the normal staff that you have. There's things that go on. We got caught, Jeff. We get. We got caught on a scam a couple weeks ago at the very start of all this Corona stuff. And it took us a month to figure it out. Make sure there's processes in place for updating payroll and things like this. What happened to us was our comptroller received an email from a company email account. One of our service advisors saying, hey, please update my bank account information. I changed banks and emails, went back and forth. And she updated the employee's bank account.
Right?
Well, payrolls go out and the money doesn't go to his account. And our service advisor did not. Didn't check his bank account for two payrolls. And all of a sudden he comes to me and says, I didn't get my pay. After we start digging, we realized it was a cloned email directing money to a different bank account. And two payrolls are gone for the. For him. Which of course, you know, we covered. But how crazy is that?
Yeah, obviously not knowing all the details or seeing this pan out yet. Crazy circumstances, right? And these guys try everything and they occasionally hit the right situation where the comp trailer and the service rider aren't in any other type of direct communication other than email. And they cloned it and he happened to not notice it for two pay periods. Like, you know, assuming this is all a straight up scammer, the guy lucked out there. The only thing that could have been better is had your service writer actually gotten paid a respectable wage, it would have been a lot more money. But yeah, what you're driving at is we got to be careful. We've got to be aware. There's got to be policies and procedures and fail safes. I know there's so many phishing accounts on Facebook where they try to get you or one of your employees to click on some link to download a pay stub and it allows them to hack into your Facebook profile. Boom, delete your whole frickin account.
And yeah, you got nothing. You know, probably what happened here is this Service advisor orders a lot of parts off ebay and places like that. It's very possible that he traded emails with someone out of the country or something like this, and they were able to clone it. I have no thoughts at all that my employee had something to do with. He's not that type of guy. That's not what happened. And, you know, our policy and procedure wasn't held, Jeff. We make people fill out a piece of paper if they're going to change their bank accounts and this, that, and other. And because my comptroller's at home during this coronavirus time, she wasn't here. This didn't happen the exact way. That's what happened. And that's unfortunate.
Yeah, it's a great call to us to just look at the places where we're weak. And that's our Monday minute, guys. Look at those places where you might have vulnerability. Is it on the test drive? Is it on the security of your car lot? Do you have a marking pen for every $150bill that you take in to avoid counterfeits? Do you have cash controls? Do you have email privacy policies? Do you have the right spam and spyware on your computers? Are they up to date? Are they even active? You know, what kind of firewalls do you have set up on your Internet browsers? There's a myriad of things, and we don't expect you to do them all at once, but maybe just tackle one.
Yeah, sure.
Yeah. Get some better lights set up and get some real cameras or some fake cameras or check your test drive policy.
You know, a lot of stuff you can do to not fall victim of things like this. And we've been lucky over the years. We haven't, but this one, you know, got us. No matter how smart you are, this can happen to you. So be vigilant.
Awesome, Luke. Great. Have an awesome week, and we will talk to you Thursday. Sounds good.