San Francisco Bay residents Harry and Joanne recently had a terrifying experience. They were driving downtown when a tow truck backed into their 2017 Corolla. At first, they thought it was an accident. Then the truck tried to latch onto their car three times while bystanders yelled at the driver. Harry honked until nearby traffic cleared the way, then he backed away from the truck and took off. But the heavy-duty truck chased them.

This towing company is in the repossession business, grabbing cars that owners have missed payments for so the bank can sell them. The city has charged one business with the same name with unscrupulous practices and forbidden it from taking city towing contracts. But here’s the kicker: Harry and Joanne didn’t owe any money on their car.

Journalists called the incident an attempted “kidnapping.” The SFPD said, “No injuries were reported, and no arrest has been made at this time…This incident is an open and active investigation.” Internet sleuths think they IDed the truck driver from the company name on his truck. He took to social media that day to complain how the world turns against you after “an honest mistake.” It is safe to assume he confused Harry and Joanne’s Corolla for another car the bank is trying to repossess. But it all begs the question: Can the bank repossess your car while you’re in it.

The simplest answer is that the bank can’t repossess your car with anyone in it. But Harry and Joanne’s story makes it clear that at least some tow truck drivers may try it.

The Federal Trade Commission says, “In many states, your lender can take your car as soon as you default on your loan or lease.” Your contract should contain more specifics. So what can the lender do to take your car? “Once you’re in default, the lender might be able to repossess your car at any time, without notice, and come onto your property to take it. But the lender can’t ‘breach the peace’ when they take it.”

The key is that “breach the piece” varies by state. Some states specify this means physical force. Other states specify threats. In other places that means removing your car from a closed garage without your permission.

Alan Smithee is a Quora user who used to be a salesman at a used car lot in Texas. He said one of the customers stopped making payments on a minivan so his boss hired a repossession company to find it and tow it.

“The repo company saw the van parked out front of a grocery store and ‘hooked it.’ Unbeknownst to them, the family left their 2 children inside the minivan. Things took an ugly turn after that. Both my company and the repo company were sued and charged with numerous offenses including kidnapping. They [the van’s buyers] wound up getting a very nice settlement from both parties.”

Alan Smithee, Quora

Not every state has the same laws as Texas, and not every lawsuit would have the same outcome. But it’s obvious that repossessing a car with people aboard is frowned upon.

So what in the world was the repo man in San Francisco planning to do? As I researched the story, I found it is surprisingly common for repo men to “hook” a car with people still inside. If they can lift the front of a FWD car–such as the 2017 Corolla–off the ground, the driver can’t drive away. All the repo man has to do is wait for the driver and passengers to get out and walk away. Then they can take the car to the bank.

Is it ethical or legal? Probably not. The tactic relies on the people in the car not knowing their rights. But if they know they’ve been missing payments, they may feel guilty and not put up a fight.