How crooks can steal your car - without the key

If you’d stolen a Range Rover and were, one Thursday this month, triumphantly driving it down the A13 from London to Tilbury Docks to stash it in a container on a ship bound for Africa, your luck was just about to run out.

Positioned on the eastbound carriageway of this busy road, on a section between Dagenham and the Dartford Crossing, was a police car fitted with an automatic numberplate recognition (ANPR) system that alerts officers to vehicles recorded as being linked to crime.

Farther down the road were four marked and unmarked pursuit cars, waiting for the nod from the ANPR police car to give chase to any vehicle that the alert system flagged up.

Nearby off a slip road, waiting patiently in the teeth of a biting easterly wind blowing across the Essex marshes, was a squad of about 30 police officers, their job to process any vehicle, and its occupants, the pursuit cars escorted in. Your reception committee, if you like, poised to read you your rights – before slapping on the cuffs.

The activity that bitterly cold Thursday afternoon was part of a week-long, region-wide operation codenamed Operation Endeavour that involved 800 police officers patrolling 20 major roads in and around London. Although the police were happy to hoover up any criminals who strayed into their net, they were particularly keen to catch those who steal ‘keyless’ vehicles – cars that can be unlocked automatically when they sense the owner’s key fob in close proximity and that have an engine start button.

The police operation came against the backdrop of a long-term fall in the number of vehicle thefts (from 318,000 in 2002 to 74,600 in the 12 months to September 2014) but a sharp rise in the number of cars stolen by gangs targeting keyless vehicles.

For example, the Metropolitan Police says that of the 24,000 vehicles stolen in London last year, 6000 were stolen without their owners’ keys, the majority of them keyless vehicles. More than 70% of such vehicles were high-value Land Rovers and BMWs but they also included Ford Fiestas and Ford Transit and Mercedes-Benz Sprinter vans.

Meanwhile, Autocar has seen confidential police reports detailing thefts of cars in London by week. It makes surprising reading. For example, during one February weekend, 17 Range Rovers were stolen across London, while in just one area, two Land Rover Defenders, one Range Rover and one Range Rover Evoque were stolen.

However, criminal gangs aren’t only targeting high-value cars like these. Again, during one recent weekend, five Fiat 500 Lounge-edition models and four 11-plate Ford Galaxys were stolen, suggesting that criminals are stealing to order.

Sammy Miller, from Birmingham, knows exactly what the owners of these cars have been through. Her two-year-old Range Rover Autobiography, which would cost around £100,000 today, was stolen from her driveway in less than 30 seconds by a keyless car thief who simply opened the door, got in and drove off.

She was in her house at the time but knew nothing about the theft until Tracker, a vehicle location company, rang her to ask if she knew her car was being driven. “I looked out of the window and couldn’t believe it: my car was gone,” Miller said later.

When she looked at her CCTV system, she was shocked to see how easy it had been for the thief to steal her car. “He just opened it, got in and was gone in 30 seconds,” she said. Fortunately, Tracker and the police located Miller’s Range Rover less than an hour later, parked up and abandoned.

With many cars stolen in this way, the outcome for their owners is rather less fortunate. Many are shipped out of the country, to Africa or eastern Europe, as a whole vehicle. Meanwhile, others are simply driven to so-called slaughterhouses where they are stripped down to their component parts for sale to the highest bidder. Typically, a Range Rover engine will make £1000 and a whole vehicle £10,000.

Sure enough, as the police were patrolling the bleak, bitterly cold A13 near Dagenham, another police team was cracking open a collection of suspicious-looking shipping containers at the Port of Felixstowe, 75 miles away. Inside, they found mountains of stolen car parts as well as five complete Range Rovers, some buried under mattresses and behind stolen bicycles.  

Back in the ‘reception’ area off the A13, news of their colleagues’ success was spreading among the shivering police officers. Success here would soon warm them up and, sure enough, bang on 2pm, it came in the form of a brilliant white Range Rover shepherded in by two police cars. Its two occupants were quickly surrounded as officers, some with sniffer dogs, probed every inch of the vehicle. Eventually, the pair were led away, in handcuffs.

In truth, the car didn’t look like one worth risking your freedom for, being a touch too old and ‘Essex’-looking. The driver eventually returned, free of his cuffs, before casually driving it away. His mate, meanwhile, remained behind. He’d been arrested for carrying a knife. 

Detective chief superintendent Carl Bussey, who led the operation, was unfazed. “The real point of this week’s operation is to educate motorists about the risk ofkeyless theft,” he said. “We’ll be bringing drivers in to tell them how they can help themselves from being victims of this growing crime.”

His advice may come as a surprise to anyone who has recently purchased a £100,000 Range Rover: fit a Krooklok or similar device. It could be enough to panic and delay a thief who has come armed with a key programmer rather than a hacksaw. In addition, said Bussey, owners should consider installing a lock on the on-board diagnostics (OBD) port and a tracking device, and park their vehicle in a well-lit area.

Bussey said the force is talking to car makers about tightening vehicle security. Their representative body, the Society of Motor Manufacturers and Traders, has told Autocar that car makers are doing all they can to respond to the problem, including applying software updates and making OBD ports harder to locate.

At the reception area on the A13, the police seemed to be waiting in vain for their hot Range Rovers and Porsches. In their place, a procession, largely of tatty vans, filed in, each with their own sorry tale of casual, opportunistic crime, such as the one stuffed full of stolen bicycles.

And then, just as we’d given up hope, in came a tasty-looking 64-plate Volkswagen Golf GTI. Police circled, dogs sniffed and investigating officers had that relaxed, confident look that comes from knowing they’ve got their man.

Only they hadn’t, quite. The car wasn’t stolen, but the dogs had found bundles of cash in it. Explain that, Mr Driver.

The A13 may not have yielded a keyless theft, but Operation Endeavour was, said the police, a huge success. Officers arrested 84 people, 16 on suspicion of vehicle theft, the rest for a range of offences including possession of offensive weapons, burglary, money laundering and driving while disqualified. In addition, they seized five Range Rovers and hundreds of vehicle parts, believed to have been from 12 BMWs stolen from London.

That long, cold wait by the A13 had been worth it after all.

How do the thieves do it?

There are a variety of ways criminals can gain access to a keyless car. The messiest one involves breaking a window. More straightforward is trying the car’s door handles first, since some models can remain unlocked if the owner’s key fob is nearby - inside the house on a window sill, for example.

If the fob is too far away for the car’s short-range security signal to communicate with it and unlock the doors, the thief can stand nearby, capture the signal on a device and transmit it to a mate with a receiver standing close to the owner a convenient distance away. This tricks the car into believing it’s close to the key fob and the doors are immediately unlocked.

Another method is to jam the signal from the owner’s key fob to the car. The owner thinks he or she has locked the car and walks away, leaving the thief to sneak on board.

Whichever way they gain access, once in the car the thief plugs a hand-held ‘key fob’ programmer, freely and legally available on the internet, into the car’s on-board diagnostics (OBD) port to record the car’s vital systems data. Car makers are obliged by law to permit rival services to access the OBD, hence the existence of such devices. Once the fob is programmed - which takes less than 15 seconds - the thief is in control of your car.

John Evans

Get the latest car news, reviews and galleries from Autocar direct to your inbox every week. Enter your email address below: