Keyless Theft: Why European Cars Are Targeted and What Actually Stops It

Start with the good news, because it is genuinely good and most people have not heard it.

Washington recorded 17,499 auto thefts in 2025 — 10,801 fewer than the year before, a drop the state’s Auto Theft Prevention Authority puts at 38%, and the lowest number in over 23 years. Through the third quarter of 2025 the state led the entire country in declining auto theft, down 40%.

Now the part buried in the same report. Among the trends WATPA flags as having increased in 2025: key fob cloning.

So the crude end of car theft is collapsing while the electronic end is growing. If you drive a keyless European car, you are in the half that is moving the wrong way.

Here is what is actually happening, and — the part most articles get wrong — why the defence against one of these attacks does nothing whatsoever against the other.

There are two completely different attacks

Almost all advice on this subject treats “keyless theft” as one problem. It is two, and they have almost nothing in common. Confusing them is how people end up with a Faraday pouch and a false sense of security.

Attack one: the relay attack

This is the common one, and it needs two people and two devices.

One stands close to your house — by the front door, a window, the wall nearest where your keys live. Their device detects and picks up the signal your fob is quietly exchanging with the world. The second person stands at your car with a device that relays that signal, so the car is presented with what appears to be your key, right there at the door handle.

The car has no way to tell the difference. It checks whether the key seems to be nearby. The relay makes it seem nearby.

Doors unlock. The start button works. There is no broken glass, no alarm, no forced lock, and the whole thing takes under a minute. Owners frequently report the car simply gone with no sign of entry at all.

And the reason this suits a neighbourhood like ours is uncomfortable: the ideal setup is a car on a driveway a few metres from a house with the keys inside it near the front door. That describes a very large share of the Eastside.

Attack two: CAN injection

This one is more sophisticated, better documented, and importantly — it does not involve your key at all.

It was pieced together by Ian Tabor of EDAG Group, who runs the UK chapter of the Car Hacking Village, and Ken Tindell, CTO of Canis Automotive Labs — after Tabor’s own 2021 Toyota RAV4 was stolen from outside his home near London. They bought one of the devices, took it apart, and published their findings in April 2023. The Toyota case was assigned CVE-2023-29389.

How it works:

1. Thieves pull the bumper and unplug the headlight harness. They are not after the headlight — they are after the wiring, because the headlight and the smart-key control unit sit on the same CAN bus. Those wires are among the easiest to reach, and getting at them does little damage, which keeps the car’s value up.
2. Plugging the device in and powering it on wakes the network, much as pulling a door handle or pressing a fob button would.
3. The device listens for a specific message, then emulates a hardware error — which causes other modules to stop transmitting, handing the device priority on the bus.
4. In that gap it sends spoofed “valid key present” messages to the gateway, which then passes along the instructions that disable the immobiliser and unlock the doors.

The device itself is the detail that sticks with people. Roughly $10 of components, hidden inside the shell of a JBL Go 3 Bluetooth speaker, sold on dark-web sites for up to around $5,500 and advertised as an “emergency start” tool for locksmiths and owners who have lost their keys. It looks like a speaker. The thief presses play, and the doors open.

Tabor’s RAV4 was gone in under two minutes.

And here is the part that matters most. The immobiliser was not cracked, bypassed or defeated. It was told the key was present — and it believed the message, because CAN traffic on these vehicles is not authenticated. A message that looks valid is treated as valid. The researchers’ conclusion was that the real fix is encrypting and authenticating the bus itself, and that quicker patches could be “re-defeated in the long run.”

An honest scope note, since we would rather be accurate than alarming: the vehicle confirmed in that research was a Toyota, and the device examined was built for Toyota. The sellers of these devices advertise them for a long list of makes including BMW, Jaguar, Maserati and Volkswagen — but that is a seller’s claim in a criminal marketplace, not verified research. Treat it as a reason to take physical security seriously, not as proof that your specific car has been broken.

Why European cars draw the attention

Four reasons, none of them mysterious:

Keyless entry is nearly universal on them. Comfort Access, Keyless Go, Advanced Key and their equivalents have been standard or near-standard on these marques for years. On a mixed street, the European cars are the ones most likely to be relay-attackable, simply because they all have the feature.

Value. Higher resale, and a higher return per vehicle for the same effort and the same risk.

Parts demand. Modules, headlight assemblies, wheels, catalytic converters and body panels for these cars are expensive — which is exactly what makes dismantling profitable.

Export demand. WATPA’s own report describes international export schemes alongside VIN swapping, re-VINning and title fraud as active parts of the problem.

What actually stops what

This is the table worth keeping. Most countermeasures address exactly one of the two attacks.

Measure

Relay attack

CAN injection

Faraday pouch or signal-blocking box

Yes — the fob cannot be reached

No — the key is irrelevant to this attack

Motion-sensing “sleeping” fob

Yes — stops responding when left still

No

Turning keyless entry off in the car’s settings

Yes

No

Steering wheel lock or wheel clamp

Yes — they can open it, not drive it

Yes — same reason

Aftermarket immobiliser or hidden kill switch requiring a PIN

Yes

Yes

Locked garage, or parking to block the car in

Yes

Yes — both need physical proximity

OBD port lock

No

Partial — the documented attack used the headlight harness, not the OBD port

GPS tracker

No — recovery, not prevention

No — recovery, not prevention

Read down the right-hand column and the pattern is stark. Against CAN injection, only physical and mechanical measures help. Everything electronic you can do about your key is irrelevant to an attack that never touches your key.

Which is why the humble steering wheel lock has quietly come back. It is not elegant, but it does not care how the doors were opened — and it is visible from outside, which makes your car the harder one on the street. WATPA’s own report credits steering wheel locks, alongside software updates, as part of why one manufacturer’s theft numbers fell sharply.

What does not work, despite being widely repeated

Leaving the fob “far enough” inside the house. Relay equipment reaches further than people assume, and the distance from your front door to your kitchen drawer is not meaningful protection. Either block the signal or do not rely on distance.

Protecting one fob and not the other. A spare in a pouch while the daily key sits in a bowl by the door protects nothing. Both fobs, every night.

Wrapping it in kitchen foil. Inconsistent and easy to get wrong. A proper pouch costs very little — and test it: lock the car, put the fob in the pouch, and try the door handle. If it opens, the pouch is not working.

Assuming the factory immobiliser has you covered. The whole point of the documented CAN injection attack is that it did not fight the immobiliser. It talked around it.

The microwave, the fridge, the biscuit tin. Please do not. Some will damage the fob and none is reliable.

The signs your car has already been looked at

This is the most useful thing in this article and it comes straight out of the research.

Tabor found his headlight harness pulled out days before his car was stolen — and reasonably put it down to vandalism. Separately, his car’s telematics logged a burst of fault codes just before the theft, including one for the control unit handling the exterior lighting.

In other words, the reconnaissance left a trace, and so did the attack. Both looked like something else at the time.

So treat the following as potential probing rather than random bad luck:

• Bumper trim, grille or headlight surround that looks disturbed, or clips that are no longer seated properly
• A headlight or marker light that suddenly stopped working with no obvious cause
• A cluster of electrical warnings that appeared and then cleared
• Any evidence of someone having been under the front of the car

And here is the practical part: your car keeps a record. Stored and historic fault codes, freeze frame data and module wake events can show what was disturbed and roughly when. If you find tampering at the front of your car, the useful response is not to replace a clip — it is to have the diagnostic memory read before that history ages out.

What we can actually do about it

Five things, and we would rather you knew they exist than found out after a theft.

Scan for evidence of tampering. If you suspect the front of your car has been interfered with, we can read the stored fault history and look for the signature of a network being woken when it should have been asleep.

Check what your car already supports. Many of these cars allow keyless entry to be disabled in the vehicle settings, and several marques now ship fobs that go to sleep when left motionless. Most owners have no idea whether theirs does. We can tell you, and switch it off if you want it off.

Fit an aftermarket immobiliser or a discreet kill switch. This is the measure that works against both attacks, because it adds a step no spoofed message can supply.

Audit and clean up the car’s key list. Your vehicle holds a list of keys it recognises, and it can be read. If a key has been lost, cloned, or simply never came back from a previous owner, it can be deleted from the car’s memory so it no longer starts the vehicle. This matters enormously on a used purchase — you have no idea how many working keys exist for a car you just bought, and most buyers never check.

Repair it properly afterwards, if the worst happens. Recovered cars frequently come back with harness damage, missing trim, broken modules and a key list full of strangers. All of that is fixable, and all of it needs doing.

Frequently asked questions

Is car theft actually getting worse in Washington?

Overall, no — substantially better. The state’s Auto Theft Prevention Authority recorded 17,499 auto thefts in 2025, which is 10,801 fewer than 2024, a drop of 38%, and the lowest total in over 23 years. Through Q3 2025 Washington led the nation in declining auto theft, down 40%. But the same report lists key fob cloning among the methods that increased in 2025. The crude end of the problem is shrinking while the electronic end grows.

What is a relay attack?

Two people with two devices. One stands near your house and picks up the signal your fob is exchanging; the other stands at the car and relays it, so the vehicle is presented with what appears to be your key at the door handle. The car cannot tell the difference, because it is only checking whether the key seems to be nearby. No glass broken, no alarm, under a minute. The ideal target is a car on a driveway a short distance from the keys inside the house.

Does a Faraday pouch really work?

Against relay attacks, yes — it is the single most effective cheap measure, because the fob cannot be reached. Against CAN injection it does nothing at all, since that attack never involves your key. Two practical notes: protect every fob, not just one, and test the pouch by locking the car, putting the fob inside and trying the door handle. If the door opens, the pouch is not working.

Doesn’t my car’s immobiliser prevent this?

Not necessarily, and understanding why matters. In the documented CAN injection case the immobiliser was not cracked or bypassed — it was sent messages indicating a valid key was present, and it accepted them, because the vehicle network does not authenticate its own traffic. The researchers concluded the real fix is encrypting and authenticating the bus. Until that is widespread, mechanical measures are what close the gap.

Which cars are affected by CAN injection?

The confirmed research case was a Toyota, and the device examined was built for Toyota. Sellers advertise these devices for many makes including BMW, Jaguar, Maserati and Volkswagen, but that is a criminal marketplace’s marketing rather than verified research. The sensible reading is to take physical security seriously regardless of badge, rather than to assume your specific model has been compromised.

What should I do if I think someone has tampered with my car?

Have the diagnostic memory read, promptly. In the documented case the owner found his headlight harness pulled out days before the theft and assumed vandalism, and the car logged a burst of fault codes including one for the exterior lighting module. Disturbed bumper or headlight trim, a light that stopped working for no reason, or electrical warnings that came and went can all be reconnaissance. The stored fault history can show what was disturbed and when — but it does not keep forever.

Worth ten minutes of our time

Next time your car is in, ask us three things: whether it can have keyless entry switched off, whether your fob is one of the sleeping type, and how many keys the car currently recognises. The third answer surprises people on used purchases more than any other check we run.

Eastside European Auto Service and Repair has been the Eastside’s dealer alternative since 2010, working on Mercedes-Benz, BMW, Audi, Volkswagen, Volvo, Porsche, Jaguar, Land Rover, MINI and Smart. ASE-certified technicians, over 75 years of combined experience, factory-level diagnostic equipment, and loaner cars available.

Call 425-823-8200 or book online. 12415 NE 124th St, Kirkland, WA 98034. Serving Kirkland, Bellevue, Bothell, Redmond, Issaquah, Mercer Island and Woodinville.