BOT PROTECTION FOR AUTO MARKETPLACES

Your Inventory Feed Is a Door. Check Who Holds Keys.

Dealer inventory feeds accumulate partners for years: aggregators, website vendors, a pilot from 2022 nobody cancelled. Each one is a full copy of your stock, pricing, and photos.

Every inventory feed partner holds a standing copy of your lot: every VIN, price, photo set, and cost adjacent field you ever included in the file. Dealers audit their DMS users and their ad spend. Almost nobody audits the feed list, so it grows by accretion, a marketplace here, a website vendor there, a data pilot someone signed at a conference and forgot. Then a former partner's credentials get phished, or a partner quietly resells the data, and inventory shows up in places the dealer never agreed to, at prices the dealer never set. The audit takes an afternoon: list every active feed destination, match each to a current contract, kill everything you cannot match, and rotate the credentials on the rest. The finding is almost always embarrassing, which is why it keeps not happening.

Build the list from the system, not from memory

Ask the DMS and the feed provider for the actual destination report, every endpoint that pulled the file in the last 90 days, with pull frequency and last successful pull. Memory produces the five partners you like. The report produces the nineteen that exist, including the test endpoint a vendor stood up during onboarding and never tore down, still pulling the full file nightly to a server nobody monitors.

Match each destination to an owner inside the store. A feed with no internal owner is a feed to suspend until someone claims it. Legitimate partners survive a 48 hour suspension with a phone call. Illegitimate or forgotten ones reveal themselves by silence, which is also information.

Related reading on this site: Home and Phantom Inventory: Why Listings Show Cars That Are Not There cover the neighbouring problems in more depth.

Fields are the quieter leak

Destinations are half the audit. Fields are the other half. Dealer feeds routinely carry more than listings need: invoice cost, pack, holdback adjacent figures, internal stock numbers, recon status notes. Listing syndication needs VIN, year, make, model, trim, mileage, price, photos, and a description. It does not need your cost structure, and any partner receiving cost fields is a partner who can undercut you with your own arithmetic if their data ever walks.

Trim the file to listing fields for every marketing destination and keep the rich file for the small set of systems that run the store. When a vendor insists cost fields are required for their dashboard, ask which report uses them and watch the answer. Half the time it is a default template nobody chose.

Rotation, logging, and the exit clause

Feed credentials should rotate like any other credential: on staff changes in internet department roles, on vendor changes, and at least annually. Log the pulls and alert on pattern breaks, a partner who pulled nightly at 2 AM suddenly pulling hourly, or a new IP range fetching the full file. Scraping rarely announces itself. A pull pattern change is often the only announcement you get.

Finally, read the exit clause before you need it. When a syndication contract ends, does the partner delete your inventory and certify the deletion, or do your listings linger on their network for months, priced as of the day you left? Stale listings from dead contracts are a top source of the phantom inventory buyers keep calling about, and they are a contract problem, not a bot problem, which means they are fixable with a pen.

Frequently asked questions

How often should a dealer audit inventory feed partners?

Twice a year is a workable cadence, plus an extra pass whenever the internet department changes staff or vendors. The audit is a destination report matched against current contracts, which takes hours rather than days once the first list exists.

What fields should a marketing inventory feed contain?

Only listing fields: VIN, year, make, model, trim, mileage, price, photos, description, and location. Cost, pack, and internal notes belong in internal systems feeds, not in files sent to marketing and syndication partners.

What is a sign a feed partner account is compromised?

Pull frequency changes, pulls from new IP ranges or geographies, full file downloads at unusual hours, and your inventory appearing on sites you never contracted with. Any one of these justifies rotating credentials and calling the partner the same day.

Why do ended syndication contracts leave listings live?

Many agreements do not require prompt deletion, so the partner's copy persists until it ages out of their system. An exit clause requiring deletion and written certification within a set number of days prevents the lingering phantom inventory.