I think we have to remember that most of us on here are very tech savvy. Most people have no idea about security and what not to do with their devices. I am sure a lot of people believe that having a four number code on their phones is enough. The number of people who think the drawing a shape method is safer than numbers amazes me. You can actually see the grease stain of the shape if you hold it in the light at the right angle.
So saying it is the victim’s fault doesn’t cut it with me. We should be able to trust people we deal with and when they betray that trust they should be held fully accountable.
As for the document, it could be an email of confirmation from the dealership’s finance company and only the reference numbers etc. was required. The scummy dealer could have claimed that he needed to check it with details he has on his PC and done the deed.