"AutoNation did not present evidence establishing security procedures that would prevent unauthorized access, or demonstrate that users were required to complete all steps before moving on," ...