TMDA News & Insights

Texas Plate & Registration Changes: What Dealers Should Be Watching

Fri, 20 Mar 2026 16:56:27 GMT

Understanding the Operational Impact Behind the Policy

Texas continues to refine how license plates and vehicle registration are handled - and while these changes may appear administrative on the surface, they can directly affect dealership workflows, compliance responsibilities, and the customer delivery experience.

Recent legislative and regulatory developments signal an ongoing effort by the state to improve traceability, reduce fraud, and modernize how vehicle ownership is documented and transferred.

For powersports dealers, these changes are worth paying attention to - not because they require immediate overhaul, but because they influence the details that keep operations running smoothly.

What’s Driving These Changes

Texas has been actively addressing issues tied to license plate misuse, title fraud, and inconsistent plate tracking.

One of the most notable shifts came with the implementation of metal license plate issuance requirements for dealers, which took effect in 2025 under changes to Texas Transportation Code and related TxDMV rules.

Building on that, proposed legislation such as Senate Bill 1902 (SB 1902) seeks to further refine how plates are handled during vehicle transactions.

Key Provisions Dealers Should Understand

While SB 1902 is still part of ongoing legislative activity, it reflects the direction Texas is moving:

Customers may be required to retain their license plates when selling or trading in a vehicle
Dealers could be permitted to transfer those plates to a replacement vehicle within a defined timeframe (e.g., 10 days)
Clear procedures would be required for handling and disposing of plates that are not transferred
The Texas Department of Motor Vehicles (TxDMV) is authorized to adopt rules supporting enforcement and database tracking

These changes are designed to create a more consistent and traceable system for plate ownership and vehicle identification.

Why This Matters for Dealership Operations

At a glance, these updates may seem procedural. In practice, they can influence several areas of dealership operations:

1. Deal Flow & Delivery Timing

Changes to plate handling can impact how quickly a transaction moves from final paperwork to customer delivery.

2. Titling & Registration Processes

Dealers may need to adjust internal workflows to ensure compliance with evolving plate transfer and documentation requirements.

3. Inventory Management

Units taken in on trade may come with different plate handling requirements, affecting intake and processing procedures.

4. Customer Communication

Clear expectations around plates - what stays, what transfers, and what changes - become part of the delivery conversation.

A Broader Shift Toward System Accountability

These updates are part of a larger trend in Texas toward:

Strengthening vehicle tracking and ownership records
Reducing opportunities for fraud and misuse
Increasing consistency across dealerships and transactions

For dealers, this means increased emphasis on accuracy, documentation, and process alignment - not necessarily increased burden, but increased precision.

What Dealers Should Be Thinking About Now

As legislation and rulemaking continue to evolve, dealers may want to consider:

Reviewing current plate handling procedures
Ensuring staff understand how plate transfers affect transactions
Monitoring updates from TxDMV and the Texas Legislature
Staying connected with TMDA for guidance and interpretation

These are not changes that require urgency - but they do reward awareness.

TMDA’s Role

TMDA is actively monitoring legislative proposals such as SB 1902 and related TxDMV rulemaking.

Our goal is to ensure Texas powersports dealers:

Understand what’s changing

Have time to adapt

Are represented in conversations that affect dealership operations

We will continue to provide updates as these policies develop and move toward implementation.

Final Thought

In many cases, the biggest operational disruptions don’t come from major policy overhauls - they come from small procedural changes that go unnoticed until they affect a deal in progress.

Staying informed allows dealers to stay ahead of those moments.

References:

Texas Transportation Code — Vehicle Registration & License Plate Requirements

Texas Department of Motor Vehicles (TxDMV) — Rulemaking and Dealer Plate Regulations

Texas Legislature Online — SB 1902 (Relating to motor vehicle license plates and registration procedures)

H.R. 3385 and the Federal Definition of “Motorcycle”

Sun, 01 Feb 2026 21:22:49 GMT

What a proposed update to federal vehicle classification could mean for autocycles, dealers, and the broader powersports industry.

A federal bill currently moving through Congress - H.R. 3385 - is prompting discussion across the motorcycle and powersports industry. For some dealers, this is already on the radar. For others, it may not yet feel urgent.

But even when a bill focuses on definitions rather than direct regulation, it is worth understanding. In transportation law, how something is defined often shapes how it is regulated.

This article is intended to clarify what the bill does, what it does not do, and why it matters to motorcycle and powersports dealers in Texas and beyond.

What H.R. 3385 Proposes

H.R. 3385 would direct the U.S. Department of Transportation to update and modernize the federal definition of “motorcycle.”

The proposal would refine the definition to more closely reflect traditional motorcycle design - including features such as:

A saddle or seat designed to be straddled
Handlebars for steering
Foot- and hand-operated controls
No more than three wheels in contact with the ground

The goal, according to supporters, is to bring greater clarity and alignment between vehicle design and federal classification standards.

At first glance, that may seem straightforward. However, the implications become clearer when we consider how certain vehicles are currently categorized.

The Autocycle Question

Vehicles such as the Polaris Slingshot (two wheels in front, one in rear) and models produced by companies like Vanderhall are commonly referred to as “autocycles.”

These vehicles:

Have three wheels
Often use a steering wheel rather than handlebars
Use automotive-style seating rather than a saddle
May include seat belts and roll hoops

Under some existing federal frameworks, these vehicles have been classified as motorcycles. That classification has allowed them to be regulated under motorcycle standards for certain safety and compliance purposes.

H.R. 3385 could change that.

The bill does not ban autocycles. It does not prohibit their sale. It does not mandate that they disappear from dealer floors.

What it may do is remove them from the federal motorcycle category - requiring regulators to determine where they properly fit within federal motor vehicle classifications.

Why Classification Matters

For dealers, definitions may seem abstract - until they affect operations.

Vehicle classification can influence:

Crash data reporting and safety statistics
Licensing requirements at the state level
Insurance underwriting practices
Compliance standards
Registration and titling processes

If federal definitions change, states may revisit their own vehicle codes to maintain alignment. That is where practical dealer impact can emerge.

For dealers who sell autocycles, this could mean future adjustments in documentation, titling workflows, or customer licensing guidance.

For dealers who do not sell these vehicles, the issue may still matter because of broader implications around how federal agencies approach vehicle modernization and classification updates.

What the Bill Does Not Do

It is important to separate discussion from speculation.

H.R. 3385:

Does not outlaw three-wheeled vehicles
Does not impose new direct restrictions on dealers
Does not change state licensing laws automatically
Does not create new equipment mandates

It directs federal regulators to refine a definition. But in regulatory environments, definitions are often the starting point for larger policy shifts.

Why This Is Worth Paying Attention To

Some dealers are already well aware of the classification debate. Others may not have encountered it yet - particularly if they do not sell autocycles.

Even for those unaffected in the short term, this bill signals something broader: federal attention toward vehicle classification modernization.

As electric vehicles, alternative mobility designs, and hybrid vehicle categories continue to evolve, classification clarity will become increasingly important.

H.R. 3385 may be narrowly focused, but it exists within a larger pattern of federal engagement in how vehicles are categorized, tracked, and regulated.

Questions Worth Considering

For dealers, association leaders, and policymakers, several questions emerge:

If autocycles are no longer federally classified as motorcycles, how will they be categorized?
Will state motor vehicle codes follow federal definitions?
Could insurance or financing frameworks shift as a result?
How should dealers communicate potential future changes to customers?

These are not alarmist questions. They are practical ones.

The Role of Industry Engagement

Legislation that begins as a technical definition update can shape how agencies, states, insurers, and regulators approach vehicle classification over time. Even subtle changes at the federal level can influence broader policy conversations.

For Texas dealers who sell or service autocycles, this bill deserves attention. For those who do not, it may still represent an early indicator of how federal agencies are thinking about modern vehicle categories and how emerging segments may be treated in the future.

TMDA is actively monitoring H.R. 3385 and related federal and state developments. Our role is to protect the interests of Texas motorcycle and powersports dealers, ensure clarity in regulatory frameworks, and communicate potential impacts early - before confusion or misalignment occurs.

We encourage dealers to stay engaged, ask questions, and participate in the policy dialogue where appropriate. Informed voices from the industry are always more effective than decisions made without industry input.

We will continue to track this legislation closely and provide updates as warranted.

Texas HB 5624 and the Inherent Risk Law

Thu, 01 Jan 2026 21:49:59 GMT

Breaking down Texas’ inherent risk law and what it means for motorcycle events, off-road riding, and dealer liability clarity.

In 2025, Texas passed HB 5624, a bill addressing civil liability related to the inherent risks of motorcycling and off-road riding activities. Some dealers and event operators have already reviewed this law closely. Others may view it as a legal update that does not immediately affect daily operations.

However, understanding HB 5624 helps clarify how Texas approaches personal responsibility, recreational risk, and business liability within the powersports environment. This article explains what the law does, what it does not do, and why it matters.

What HB 5624 Does

HB 5624 establishes that participants in certain motorcycle and off-road riding activities assume the inherent risks associated with those activities.

“Inherent risk” refers to dangers that are an unavoidable part of the activity itself - even when reasonable care is exercised.

Under this framework, property owners and event operators may receive protection from civil liability for injuries or damages that result from those inherent risks.

This protection does not extend to:

Gross negligence
Reckless conduct
Intentional harm
Concealed or undisclosed hazards

The law recognizes that riding - on-road or off-road - involves risk, while preserving accountability for negligent behavior.

What the Law Does Not Do

HB 5624 does not eliminate liability entirely.

It does not:

Shield businesses from claims involving gross negligence
Remove the need for safety protocols
Replace sound event management practices
Override insurance requirements

Instead, it clarifies the boundary between assumed recreational risk and negligent conduct.

Why This Matters to Dealers

While the law may appear more relevant to event operators, many Texas dealers:

Host demo ride events
Sponsor off-road riding experiences
Partner with training schools
Support track days or riding clubs
Provide access to riding property

In these situations, understanding the legal landscape is essential.

HB 5624 reinforces that participation in riding activities carries assumed risk - while maintaining safeguards against reckless or negligent behavior.

For dealers involved in experiential marketing and community engagement, that distinction provides meaningful clarity.

The Broader Policy Context

Texas has extended inherent risk protections to industries such as equine sports and agritourism. HB 5624 places motorcycle and off-road riding within that broader recreational framework.

It reflects a policy stance that individuals voluntarily participating in inherently risky activities accept those risks - and that businesses facilitating those activities should not be liable for unavoidable outcomes.

For an industry mindful of liability exposure, this clarification is significant.

Practical Considerations for Dealers

Even with these protections, best practices remain critical.

Dealers involved in riding events or property access should continue to:

Maintain appropriate insurance coverage
Use properly structured waivers and signage
Follow manufacturer demo protocols
Implement reasonable safety procedures
Ensure hazards are not concealed

The law provides guardrails - not blanket immunity.

Why Awareness Matters

Whether a dealership actively hosts events or not, HB 5624 reflects how Texas views responsibility in recreational powersports participation.

Clarity in liability frameworks reduces ambiguity and benefits businesses operating in good faith.

TMDA’s Role

TMDA monitors legislation like HB 5624 because liability frameworks directly affect dealer operations and long-term industry stability.

Our priorities remain clear:

Protecting Texas powersports dealers from unnecessary regulatory burdens
Supporting legal clarity in recreational policy
Ensuring responsible businesses are not unfairly exposed to expanded liability

We will continue tracking developments and communicating practical implications for Texas dealers.

HB 2963 and the “Right to Repair”

Wed, 21 May 2025 19:52:35 GMT

A recently proposed bill, HB 2963, is gaining attention in the Texas Legislature for its bold move toward “Right to Repair” standards for digital electronic equipment. While the bill is currently pending in a Senate committee, it has implications worth noting – especially for dealers and service professionals in the powersports industry.

What the Bill Proposes
HB 2963 would require manufacturers of certain digital electronic products to provide independent repair shops and consumers access to diagnostic tools, documentation, and replacement parts – on “fair and reasonable” terms. These requirements would expand the market by giving more entities the resources needed to perform repairs outside the original equipment manufacturer (OEM) network. There are major drawbacks to consumers, dealers and OEMs that have dealers and OEMs opposing the bill.

Critically, the bill does not apply to motorcycles or autocycles, however, powersports OHV, PWC and Boats are not exempt.

This bill also sets a precedent that may influence OEM relationships, parts distribution practices, and customer expectations, even in exempt sectors.

TMDA’s Advocacy
TMDA’s lobbyist, Royce Poinsett, is monitoring the progress of this legislation and any proposed amendments. TMDA is actively seeking an exemption for all powersports from the effects of the bill. The bill has been approved by the House but must still pass the Senate committee, the full Senate, and be approved by the Governor. We will continue to keep members updated on this and any future “Right to Repair” developments.

If passed, HB 2963 would take effect on September 1, 2026.

A Win for Texas Powersports Dealers

Wed, 11 Sep 2024 19:58:37 GMT

We are pleased to acknowledge our team’s tremendous efforts and dedication at the Texas Motorcycle Dealers Association (TMDA) over the past several years. Through our concerted efforts, we have been tirelessly working to achieve a justifiable increase in the document fee for our industry.

We are delighted to inform you that our efforts have borne fruit! The State of Texas has acknowledged the need to adjust our document fee to a market rate. As of September 5th, 2024, dealers may now increase the document fee to up to $200 per contract. This would equate to an ADDITIONAL $7500 in revenue per 100 units sold!

This milestone would not have been possible without our lobbyists’ relentless work and our Dealers’ active participation. Your commitment to joining forces and contributing to our cause has been invaluable in mitigating the expenses associated with this initiative.

As we continue to work towards our goals, we encourage everyone to stay engaged and support our ongoing efforts. Together, we can ensure that our industry remains competitive and fair.

Thank you once again for your dedication and hard work.

Sincerely,

Texas Motorcycle Dealers Association

Here is the description of the new rule.

Here is the officially published rule as effective in the Texas Administrative Code.

HB 3861: Enhancing Efficiency in Title Applications for Dealers

Thu, 23 May 2024 20:05:44 GMT

The Texas House of Representatives recently passed House Bill 3861 (HB 3861), which is now awaiting approval in the Senate. If this bill passes, it will mandate the use of webDEALER, an online platform, for processing most title applications by dealers. The introduction of webDEALER aims to streamline the paperwork process at local tax offices, reducing wait times and improving efficiency. While the majority of county Tax Assessors support HB 3861, concerns have been raised by some regarding the suitability of webDEALER for all dealers and specific transaction types.

The Benefits and Concerns

webDEALER has long been recommended as a valuable tool for dealers, but there are concerns about making it mandatory. Certain transaction types, such as applying for initial handicap plates and antique tags, cannot be processed on the webDEALER system, which presents a challenge for dealers specializing in these vehicles. Additionally, some dealers rely on full-service deputies to handle their paperwork. Regardless, there is a pressing need for faster processing times at tax offices, benefiting both dealers and consumers.

Dealers’ Responsibility

Dealers have an important role to play in helping their local tax offices expedite customer paperwork. Several measures can be taken to speed up the process and are within YOUR control. One crucial aspect is ensuring the completeness of all submitted paperwork. Incomplete or flawed documentation can significantly delay the tax office’s processing time. According to state law, a vehicle is considered titled once the tax office receives properly completed paperwork. Hence, dealers will not be penalized for any delays caused by the tax office, as long as the paperwork was correctly submitted.

Embracing webDEALER

One effective way to expedite the process is by signing up for webDEALER, provided it aligns with the dealership’s needs. The adoption of webDEALER allows tax office employees to process four to five times more transactions compared to in-person drop-offs. If a dealer has yet to sign up for webDEALER, it is recommended to consult with the local tax office to initiate the process. Training resources for webDEALER can be accessed at https://www.txdmv.gov/dealers/webdealer/resources.

Monitoring Progress

At present, HB 3861 is awaiting a Senate hearing. If no hearing occurs within the next two weeks, the bill will not pass and become law. The passage of HB 3861 and the potential implementation of webDEALER for title applications mark a significant step toward streamlining processes and reducing wait times at tax offices. While concerns have been raised regarding the suitability of webDEALER for all dealers and specific transaction types, the overall aim is to improve efficiency for the benefit of dealers and consumers alike. Dealers should remain proactive in assisting their local tax offices by ensuring complete and accurate paperwork submission.

We continue to monitor the progress of HB 3861 and will provide updates accordingly, keeping dealers informed of any changes or decisions made.

 This post has been adapted from an article by Earl Cooke of Texas Independent Automobile Dealers Association .

Changes Coming in 2024 for Filing IRS Form 8300

Wed, 13 Sep 2023 20:00:58 GMT

Does your business receive large amounts of cash or cash equivalents? If so, you’re generally required to report these transactions to the IRS — and not just on your tax return. Beginning January 1, 2024, this reporting will have to be done electronically. Dive into this piece to understand the form’s purpose, its filing requirements, and the latest adjustments in the regulations.

Form 8300 and Reporting Cash Payments of Over $10,000

The Form 8300, Report of Cash Payments Over $10,000 in a Trade or Business, provides valuable information to the Internal Revenue Service and the Financial Crimes Enforcement Network (FinCEN) in their efforts to combat money laundering. Money is “laundered” to conceal illegal activity, including the crimes that generate the money itself, such as drug trafficking, tax evasion, and terrorist financing.

Who Must File

A “person” who must file Form 8300 includes an individual, company, corporation, partnership, association, trust or estate.

You must file Form 8300 electronically with FinCEN, or in paper-form with the IRS, if any part of the transaction occurs within any of the 50 states, the District of Columbia or a U.S. possession or territory (American Samoa, The Commonwealth of the Northern Mariana Islands, Guam, Puerto Rico and the U.S. Virgin Islands).

Note : See How to File . Electronic filing mandate starting January 1, 2024.

When to File

You must file Form 8300 within 15 days after the date the cash transaction occurred.

Besides filing Form 8300, you also need to provide a written statement to each party whose name you included on the Form 8300 by January 31 of the year following the reportable transaction. This statement must include the name, address, contact person and telephone number of your business and the aggregate amount of reportable cash. The statement must also indicate that you provided this information to the IRS.

Persons who file the required Form 8300 and do not provide a written statement to each person named on Form 8300 are subject to penalties. Penalty amounts are adjusted annually for inflation.

Keep in mind, when Forms 8300 filed due to suspicious activity that are filed under the $10,000 threshold and box 1b is checked off on the form, the statement is not to be provided to the individuals identified on the form. Forms filed under the dollar threshold are not required to be filed. Filing under the threshold is done on a voluntary basis. IRS highly encourages you to file suspicious activity when identified regardless of the dollar amount. Forms marked as suspicious are also treaded confidentially.

How to File

Effective January 1, 2024, you must electronically file (e-file) Forms 8300 if you’re required to e-file other information returns, such as Forms 1099 series and Forms W-2. You must e-file your Forms 8300 if you’re required to file at least 10 information returns of one or more type(s) other than Form 8300 during a calendar year.

For example, if you’re required to file five Forms W-2 and five Forms 1099-INT, then you’re required to file certain other information returns during that year electronically, including any Forms 8300. However, if you file less than 10 total information returns other than Forms 8300, you’re not required to file the information returns electronically and not required to file any Forms 8300 electronically. The number of Forms 8300 you file does not affect the electronic filing requirement.

Keep in mind, if you’re not required to e-file, you can still choose to do so.

Businesses that are not required to file their Forms 8300 electronically that choose to physically mail in their Forms 8300 to the IRS, will send their forms to:

Internal Revenue Service
Detroit Federal Building
P.O. Box 32621
Detroit, MI 48232

Waivers

You may file a request for a waiver from filing information returns electronically due to undue hardship. For more information, refer to Form 8508, Request for Waiver from Filing of Information Returns PDF. If the IRS grants you a waiver from electronically filing information returns, the waiver automatically applies to all Forms 8300 for the duration of the calendar year.

You must include the word ‘WAIVER’ on the center top of each Form 8300 (Page 1) when submitting the paper filed returns.

Note: Waivers for electronic filing are not required when business files less than 10 total information returns other than Forms 8300.

Exemptions

If using the technology required to e-file conflicts with your religious beliefs, you are automatically exempt from filing Form 8300 electronically. You must include the words “RELIGIOUS EXEMPTION” on the center top of each Form 8300 (Page 1) when submitting the paper-filed returns.

Penalty for Paper Filing

If you are required to e-file but file by paper and you don’t have a waiver or religious exemption, you will be subject to a failure to file penalty.

Late Returns

You must identify late returns. You must file a late Form 8300 in the same way, either electronically or on paper, as a timely filed Form 8300. When filing a late Form 8300 electronically you must include the word “LATE” in the comments section of the return. When filing a late Form 8300 on paper you must write “LATE” on the center top of each Form 8300 (Page 1).

Note: Failure to file timely includes a failure to file in the required manner. If you are required to file electronically and failed to do so, Form 8300 would be considered late. Forms 8300 that are late are subject to penalty.

Recordkeeping

Remember, you must keep a copy of Form 8300 for five years. When e-filing, be sure to save a copy of the form before you finish submitting the return. Confirmation receipts don’t meet the recordkeeping requirement. You should associate the confirmation number with the saved copy.

Form 8300 Resources

Phishing Attacks On the Rise Again: Do You Know How to Protect Your Business?

Wed, 24 May 2023 20:04:21 GMT

As businesses increasingly rely on digital platforms, cybercriminals find new ways to exploit vulnerabilities. One of the most prevalent and concerning threats is phishing attacks. These attacks have seen a resurgence recently, targeting businesses of all sizes and industries. To shed light on this growing issue and provide valuable insights, we have gathered tips to combat phishing and quotes from the Federal Trade Commission (FTC) to help protect your business from these malicious attacks.

The Resurgence of Phishing Attacks

Phishing attacks involve fraudulent attempts to obtain sensitive information such as login credentials, financial data, or personal information by posing as a trustworthy entity. These attacks are typically carried out through deceptive emails, text messages, or websites that mimic legitimate organizations.

Despite increased awareness and security measures, phishing attacks have resurfaced with renewed vigor. Cybercriminals are employing sophisticated tactics, exploiting human vulnerabilities, and leveraging current events to manipulate unsuspecting employees.

Tips to Combat Phishing

Educate Your Employees: Training and awareness programs are essential in equipping employees with the knowledge to identify and respond to phishing attempts. Teach them to scrutinize emails and messages for signs of phishing, such as suspicious links, misspellings, or requests for personal information.

Implement Multi-Factor Authentication (MFA): MFA adds an extra layer of security by requiring users to provide additional verification beyond passwords. By implementing MFA, even if an attacker gains access to login credentials, they would still require an additional form of authentication.

Keep Software and Systems Updated: Regularly update your operating systems, antivirus software, firewalls, and other security tools to ensure you have the latest patches and protections against known vulnerabilities.

Use Robust Spam Filters: Deploy robust email filters to prevent phishing emails from reaching employees’ inboxes. These filters can analyze incoming messages for suspicious content and potential phishing indicators.

Encourage Vigilance with Links and Attachments: Advise employees to exercise caution when clicking on links or opening attachments, especially if they are unsolicited or appear suspicious. Encourage them to independently verify the legitimacy of the sender before taking any action.

If you got a phishing email or text message, report it. The information you give helps fight scammers.

• If you got a phishing email, forward it to the Anti-Phishing Working Group at reportphishing@apwg.org.
• If you got a phishing text message, forward it to SPAM (7726).
• Report the phishing attempt to the FTC at ReportFraud.ftc.gov.

From the FTC

Phishing emails and text messages often tell a story to trick you into clicking on a link or opening an attachment. You might get an unexpected email or text message that looks like it’s from a company you know or trust, like a bank or a credit card, or a utility company. Or maybe it’s from an online payment website or app. The message could be from a scammer, who might:

• say they’ve noticed some suspicious activity or log-in attempts — they haven’t
• claim there’s a problem with your account or your payment information — there isn’t
• say you need to confirm some personal or financial information — you don’t
• include an invoice you don’t recognize — it’s fake
• want you to click on a link to make a payment — but the link has malware
• say you’re eligible to register for a government refund — it’s a scam
• offer a coupon for free stuff — it’s not real

Here’s a real-world example of a phishing email:

Imagine you saw this in your inbox. At first glance, this email looks real, but it’s not. Scammers who send emails like this one hope you won’t notice it’s a fake.

Here are signs that this email is a scam, even though it looks like it comes from a company you know — and even uses the company’s logo in the header:

• The email has a generic greeting.
• The email says your account is on hold because of a billing problem.
• The email invites you to click on a link to update your payment details.

While real companies might communicate with you by email, legitimate companies won’t email or text with a link to update your payment information. Phishing emails can often have real consequences for people who give scammers their information, including identity theft. And they might harm the reputation of the companies they’re spoofing.

Examples of Phishing to Look Out For

Fake Login Page: Attackers create a convincing replica of a legitimate login page, such as for a bank, email provider, or social media platform. The page typically includes a logo, input fields for usernames and passwords, and may even have a secure padlock symbol. However, upon entering the credentials, the information is captured by the attacker.

Malicious Attachments: Phishing emails often contain attachments, such as PDFs or Office documents, that appear harmless but contain malware or malicious scripts. The email may masquerade as an invoice, shipping notification, or important document, urging the recipient to open the attachment. Once opened, the malware is installed, compromising the victim’s system.

Account Verification Scams: Attackers send emails or messages claiming that the recipient’s account needs urgent verification or has been compromised. They may include official-looking logos and request the user to click on a link to verify their account. The link leads to a fake website where the user is prompted to enter their login credentials, which are then stolen.

Lottery or Prize Scams: Phishing emails may notify recipients that they have won a lottery, contest, or prize. The message may include enticing images of the supposed winnings or a fake check. To claim the prize, the recipient is asked to provide personal information, including bank details, which the attackers can exploit.

CEO Fraud/Business Email Compromise: In this targeted attack, scammers pose as high-ranking executives or business partners and send emails to employees, requesting urgent money transfers or confidential information. The emails often appear authentic, using the executive’s name, signature, and official branding.

Conclusion

As phishing attacks make a resurgence, it is crucial for businesses to be proactive in their defense strategies. By implementing robust security measures, educating employees, and remaining vigilant, you can significantly reduce the risk of falling victim to these malicious schemes.

Remember, cybercriminals continuously adapt their tactics, making it essential to stay updated on the latest phishing trends and prevention techniques. By following the tips provided and leveraging guidance from organizations like the FTC, you can fortify your business against phishing attacks and safeguard your sensitive information and valuable assets. Stay vigilant, stay informed, and protect your business from the rising tide of phishing threats.

What Does A Reasonable Information Security Program Look Like? June 2023 Deadline Is Looming.

Tue, 16 May 2023 20:08:08 GMT

Section 314.4 of the Safeguards Rule identifies nine elements that your company’s information security program must include. Let’s take those elements step by step.

a. Designate a Qualified Individual to implement and supervise your company’s information security program. The Qualified Individual can be an employee of your company or can work for an affiliate or service provider . The person doesn’t need a particular degree or title. What matters is real-world know‑how suited to your circumstances. The Qualified Individual selected by a small business may have a background different from someone running a large corporation’s complex system. If your company brings in a service provider to implement and supervise your program, the buck still stops with you. It’s your company’s responsibility to designate a senior employee to supervise that person. If the Qualified Individual works for an affiliate or service provider, that affiliate or service provider also must maintain an information security program that protects your business.

b. Conduct a risk assessment. You can’t formulate an effective information security program until you know what information you have and where it’s stored. After completing that inventory, conduct an assessment to determine foreseeable risks and threats – internal and external – to the security, confidentiality, and integrity of customer information. Among other things, your risk assessment must be written and must include criteria for evaluating those risks and threats. Think through how customer information could be disclosed without authorization, misused, altered, or destroyed. The risks to information constantly morph and mutate, so the Safeguards Rule requires you to conduct periodic reassessments in light of changes to your operations or the emergence of new threats.

c. Design and implement safeguards to control the risks identified through your risk assessment. Among other things, in designing your information security program , the Safeguards Rule requires your company to:

Implement and periodically review access controls. Determine who has access to customer information and regularly reconsider whether they still have a legitimate business need.
Know what you have and where you have it. A fundamental step to effective security is understanding your company’s information ecosystem. Conduct a periodic data inventory, noting where it’s collected, stored, or transmitted. Keep an accurate list of all systems, devices, platforms, and personnel. Design your safeguards to respond with resilience.
Encrypt customer information on your system and when it’s in transit. If it’s not feasible to use encryption , secure it by using effective alternative controls approved by the Qualified Individual who supervises your information security program.
Assess your apps. If your company develops its own apps to store, access, or transmit customer information – or if you use third-party apps for those purposes – implement procedures for evaluating their security.
Implement multi-factor authentication for anyone accessing customer information on your system. For multi-factor authentication , the Rule requires at least two of these authentication factors: a knowledge factor (for example, a password); a possession factor (for example, a token), and an inherence factor (for example, biometric characteristics). The only exception would be if your Qualified Individual has approved in writing the use of another equivalent form of secure access controls.
Dispose of customer information securely. Securely dispose of customer information no later than two years after your most recent use of it to serve the customer. The only exceptions: if you have a legitimate business need or legal requirement to hold on to it or if targeted disposal isn’t feasible because of the way the information is maintained.
Anticipate and evaluate changes to your information system or network. Changes to an information system or network can undermine existing security measures. For example, if your company adds a new server, has that created a new security risk? Because your systems and networks change to accommodate new business processes, your safeguards can’t be static. The Safeguards Rule requires financial institutions to build change management into their information security program.
Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. Implement procedures and controls to monitor when authorized users are accessing customer information on your system and to detect unauthorized access.

d. Regularly monitor and test the effectiveness of your safeguards. Test your procedures for detecting actual and attempted attacks. For information systems , testing can be accomplished through continuous monitoring of your system. If you don’t implement that, you must conduct annual penetration testing , as well as vulnerability assessments, including system-wide scans every six months designed to test for publicly-known security vulnerabilities. In addition, test whenever there are material changes to your operations or business arrangements and whenever there are circumstances you know or have reason to know may have a material impact on your information security program.

e. Train your staff. A financial institution’s information security program is only as effective as its least vigilant staff member. That said, employees trained to spot risks can multiply the program’s impact. Provide your people with security awareness training and schedule regular refreshers. Insist on specialized training for employees, affiliates, or service providers with hands-on responsibility for carrying out your information security program and verify that they’re keeping their ear to the ground for the latest word on emerging threats and countermeasures.

f. Monitor your service providers. Select service providers with the skills and experience to maintain appropriate safeguards. Your contracts must spell out your security expectations, build in ways to monitor your service provider’s work, and provide for periodic reassessments of their suitability for the job.

g. Keep your information security program current. The only constant in information security is change – changes to your operations, changes based on what you learn during risk assessments, changes due to emerging threats, changes in personnel, and changes necessitated by other circumstances you know or have reason to know may have a material impact on your information security program . The best programs are flexible enough to accommodate periodic modifications.

h. Create a written incident response plan. Every business needs a “What if?” response and recovery plan in place in case it experiences what the Rule calls a security event – an episode resulting in unauthorized access to or misuse of information stored on your system or maintained in physical form. Section 314.4(h) of the Safeguards Rule specifies what your response plan must cover:

The goals of your plan;
The internal processes your company will activate in response to a security event;
Clear roles, responsibilities, and levels of decision-making authority;
Communications and information sharing both inside and outside your company;
A process to fix any identified weaknesses in your systems and controls;
Procedures for documenting and reporting security events and your company’s response; and
A post-mortem of what happened and a revision of your incident response plan and information security program based on what you learned.

i. Require your Qualified Individual to report to your Board of Directors. Your Qualified Individual must report in writing regularly – and at least annually – to your Board of Directors or governing body. If your company doesn’t have a Board or its equivalent, the report must go to a senior officer responsible for your information security program. What should the report address? First, it must include an overall assessment of your company’s compliance with its information security program. In addition, it must cover specific topics related to the program – for example, risk assessment, risk management and control decisions, service provider arrangements, test results, security events and how management responded, and recommendations for changes in the information security program.

TMDA News & Insights

Texas Plate & Registration Changes: What Dealers Should Be Watching

Understanding the Operational Impact Behind the Policy

What’s Driving These Changes

Key Provisions Dealers Should Understand

Why This Matters for Dealership Operations

A Broader Shift Toward System Accountability

What Dealers Should Be Thinking About Now

TMDA’s Role

Final Thought

H.R. 3385 and the Federal Definition of “Motorcycle”

What a proposed update to federal vehicle classification could mean for autocycles, dealers, and the broader powersports industry.

What H.R. 3385 Proposes

The Autocycle Question

Why Classification Matters

What the Bill Does Not Do

Why This Is Worth Paying Attention To

Questions Worth Considering

The Role of Industry Engagement

Texas HB 5624 and the Inherent Risk Law

Breaking down Texas’ inherent risk law and what it means for motorcycle events, off-road riding, and dealer liability clarity.

What HB 5624 Does

What the Law Does Not Do

Why This Matters to Dealers

The Broader Policy Context

Practical Considerations for Dealers

Why Awareness Matters

TMDA’s Role

HB 2963 and the “Right to Repair”

A Win for Texas Powersports Dealers

HB 3861: Enhancing Efficiency in Title Applications for Dealers

Changes Coming in 2024 for Filing IRS Form 8300

Form 8300 and Reporting Cash Payments of Over $10,000

Who Must File

When to File

How to File

Waivers

Exemptions

Penalty for Paper Filing

Late Returns

Recordkeeping

﻿ Form 8300 Resources

Phishing Attacks On the Rise Again: Do You Know How to Protect Your Business?

What Does A Reasonable Information Security Program Look Like? June 2023 Deadline Is Looming.

Form 8300 Resources