Security: New cars that can be stolen in less than 30 seconds

New exclusive What Car? research shows that some of the latest and most popular models with keyless entry can be broken into in just seconds. Here, we list the cars that can be nicked in the time...

Car theft rates in England and Wales have reached an eight-year high, with more than 106,000 stolen last year alone.

Man breaking into a car

Vehicles fitted with keyless entry and start systems are being targeted by thieves. Criminals using specialist tools can capture a key’s signal and relay it to another device next to the car, allowing them to enter and start the vehicle.

What Car? tested seven different models, all fitted with keyless entry and start technology. Our car security experts were able to break into a number of models within a matter of seconds. Let’s take a look...

Slideshow story – click the right-hand arrow above to continue:

How we tested them

Man attempting to break into a Land Rover

To find out how vulnerable keyless entry and start systems make cars to theft, we asked two security experts – Ron Cliff (left) and Voskan Pehlivanjan from Edilock – to use any non-damaging technology to gain access to seven cars with keyless entry.

In five instances, our fake thieves used a form of entry that’s often referred to as a relay attack. It involves two electronic devices – one to pick up the signal from the key fob and a booster unit that repeats the code next to the car door to open it. On two of the cars, they used a lock-picking device to unlock the doors.

We measured the time it took them to gain entry to each car and the time to start the engine, and combined these two to give us a total theft time so we could compare them. In general, keyless entry fobs have a range of five to six metres, so one of the scanner units has to be no farther than this from the fob. The distance between the two scanners can be up to 50 metres, though, so don’t think that your car is safe just because the keys are a fair distance from it; if a thief can get close to the fob, the car is vulnerable.

Let’s take a look at the cars we tested:

DS3 Crossback Puretech 155 Ultra Prestige

DS3 Crossback Puretech 155 Ultra Prestige

Get into car: 5sec

Drive away: 5sec

All DS 3 Crossback models come with keyless entry as standard. The car’s flush-fitting door handles popped out to give our thieves access after just five seconds. It was also easy for them to repeat the code to start the engine using the push-button starter.

The PSA Group, the parent company of DS, responded by saying: “PSA Group has created a dedicated division to analyse and treat potential or proven weaknesses of vehicle security, including to monitor statistics and internet activity. PSA Group works closely with the police and regulatory authorities in order to analyse theft methods.” It also said the keyless entry systems on the latest cars could be deactivated by dealers if owners were concerned.

Land Rover Discovery Sport TD4 180 HSE (2018 model)

Land Rover Discovery Sport TD4 180 HSE (2018 model)

Get into car: 10sec

Drive away: 20sec

We tested a second Land Rover model because Jaguar Land Rover hasn’t chosen to add ultra-wide-band radio technology to all of its models, and we don’t believe the Discovery Sport has this added security. As with the Discovery (covered later in this story), our thieves used a lock picker to get into the Discovery Sport.

They were then able to plug a device into the car’s onboard computer to get the necessary code to fire up the engine via its push-button starter. Land Rover declined to comment on our tests of the Discovery and Discovery Sport.

Ford Fiesta 1.0 EcoBoost 140 ST-Line X

Ford Fiesta 1.0 EcoBoost 140 ST-Line X

Sleeping key fob inactive

Get into car: Not possible

Drive away: Not possible

Sleeping key fob active

Get into car: 40sec

Drive away: 20sec

The Fiesta comes with a ‘sleeping key fob’ with a motion sensor inside that makes it inactive when it hasn’t been moved for 40 seconds. The sleeping key fob prevented our thieves from getting into the car when it had been untouched for the specified time, but the moment it was moved, they were able to grab its code and open the car doors. The sleeping key fob has recently been made standard equipment on all new Fiesta and Focus models.

The company says these key fobs will be rolled out across the entire car and van range in due course. Owners of current Fiesta and Focus models can buy a new key fob for £62 and £72 respectively, plus 0.9 hours’ labour to program and test the key. Alternatively, owners of the latest Ford models can disable the keyless entry function via the car’s steering wheel-mounted controls.

Land Rover Discovery SD6 HSE

Land Rover Discovery SD6 HSE

Get into car: 20sec

Drive away: Not possible

Our thieves had to use a lock picker to open the Discovery’s driver’s door, setting the car’s alarm off. And they weren’t able to start the engine, because the car was fitted with ultra-wide-band radio technology, which transmits over a wide range of frequencies at once to stop thieves from being able to pick up the signal.

Mercedes-Benze A-Class A220 AMG Line

Mercedes-Benze A-Class A220 AMG Line

Keyless-Go key fob inactive

Get into car: Not possible

Drive away: Not possible

Keyless-Go key fob active

Get into car: 30sec

Drive away: 20sec

The A-Class has a Keyless-Go keyless entry fob, which can either be deactivated immediately by pressing a button or will turn itself off when it’s been motionless for two minutes. We believe this technology would protect the car from theft when it’s parked on a driveway late at night. However, when the motion sensor hasn’t kicked in or the fob manually deactivated, the car could be stolen in less than one minute.

A spokesman for Mercedes said: “All our Keyless-Go keys can be switched off by pressing the locking button on the key twice and the latest generation of Keyless-Go keys are equipped with a built-in motion sensor. This means that if the key is motionless – for example, in a drawer or on a hook – after two minutes, no Keyless-Go signals are sent out and the signals from the key cannot be hijacked.”

Audi TT RS Roadster

Audi TT RS Roadster

Advanced Key inactive

Get into car: Not possible

Drive away: Not possible

Advanced Key active

Get into car: 5sec

Drive away: 5sec

The TT RS Roadster doesn’t come with keyless entry as standard; without it, it’s harder to get into than when it’s specced with the £1495 Comfort and Sound Pack, which includes the Advanced Key keyless entry system. The optional fob has a motion sensor, but it can’t be put to sleep immediately and doesn’t cut in until the fob has been motionless for 15 minutes. We believe this would prevent thieves from taking the car from a driveway at night.

However, with the key fob awake, our fake thieves could drive away in the TT in just 10 seconds. In response, Audi’s parent company, the VW Group, said: “We are continually working on improving our security measures in order to hinder or prevent such manipulation. We closely observe how thieves work and discuss this topic with police authorities and insurers.”

BMW X3 XDrive20i M Sport (2018 model)

BMW X3 XDrive20i M Sport (2018 model)

Digital smart key inactive

Get into car: Not possible

Drive away: Not possible

Digital smart key active

Get into car: 40sec

Drive away: 20sec

BMW declined to provide us with a car for our test, so we sourced one elsewhere. Our X3 has a digital smart key with motion sensor technology – part of a Technology Pack that’s standard with Sport trim. BMW told us that the Comfort Access system on the smart key has a “security system that automatically cuts off the signal emitted from the key when it has been stationary for a set amount of time”.

We believe this is two minutes; the key cannot be activated immediately. However, when the motion sensor technology hasn't cut the signal the key's code can still be picked up and we were able to steal the X3 in 60 seconds. When the motion sensor technology is working, this would prevent the car from being stolen.

However, we were only given the standard key, because the owner had been having trouble recharging the smart key and wasn’t using it. With this key, we were able to steal the X3 in 60 seconds. We expect the smart key fob would prevent the car from being stolen once the motion sensor technology had cut in. A spokesman also said all new BMW and Mini keyless entry keys now have motion sensor technology as standard.

“Every single case we are aware of where a relay attack method has been used is when the key is left unattended and not in a pocket – hence our approach to the solution.” He added that owners of many older BMW models can pay to have the motion sensor technology retrofitted; the price of this differs between models.

How to keep your car safe

Two people attempting to break into a red Mazda 6

If your car has a motion sensor keyless fob or one that can be deactivated by pressing a button, make sure you use this function when the car isn’t being used. If your car doesn’t have a motion sensor key fob, check with a main dealer to see if you can buy one.

Consider having keyless entry disabled; you can do this yourself on some cars from Citroën and Renault, while others require you to take the car to a dealership and might charge for this.

Invest in a Faraday bag or other car signal blocking pouch and keep the key in it all the time you’re not using the car. Make sure it’s big enough to close securely with the key in it.

Care of keys

Two people attempting to break into a red Mazda 6

If possible, keep the keys at least five metres away from front doors and windows, but better still, put them in a safe overnight to prevent burglars from stealing them too.

Invest in a steering wheel lock. It may sound like an old-fashioned solution, but this will deter thieves from trying to take your car, because they’ll need to expend time and effort removing it. According to the police, cars with steering locks fitted are the least likely to be stolen.

Thatcham’s new ratings for security

Audi E-Tron

Some of the latest advances in car security have been highlighted by Thatcham Research, the safety and security organisation that administers the car insurance group rating system. It launched a new security rating system in March to give motorists a better understanding of how vulnerable specific new cars are to keyless entry/start theft.

The ratings are ‘superior’, ‘good’, ‘poor’ and ‘unacceptable’, and they’re awarded based on how well a car performs in a range of security tests. These include one that identifies digital vulnerabilities in keyless entry systems, plus an onboard diagnostic port test to see if it can be hacked and a blank key coded up.

Eighteen cars have been tested so far and, according to Thatcham, nine are rated as poor: the DS 3 Crossback, Ford Mondeo, Hyundai Nexo, Kia Proceed, Lexus UX, Mazda 3, Toyota RAV4, Toyota Corolla Hybrid and Volvo S60. The Suzuki Jimny is rated as unacceptable. Eight cars gained a superior rating: the Audi E-tron (pictured), BMW 7 Series, BMW X7, Jaguar XE, Range Rover Evoque, Mercedes-Benz B-Class, Porsche 911 and Porsche Macan.

Final comment from What Car?

Audi TT interior image

It’s outrageous that some car makers have introduced keyless entry and keyless start systems without making them anywhere near as secure as the traditional alternatives they’ve replaced.

Criminals are able to circumvent the other security systems on these cars, such as alarms and immobilisers, by hacking into their codes. It is great news that a small number of brands, including Audi, BMW, Ford, Jaguar Land Rover and Mercedes-Benz, have introduced new technology to combat theft. We particularly applaud Jaguar and Land Rover for developing a system that prevents cars from being driven away, although we think this should be rolled out across all of its models.

The motion sensor technology introduced by other car makers is also a great step towards improving security. While it protects cars from the most common type of theft – being taken from driveways in the middle of the night – it’s not a foolproof solution that owners can rely on to keep their cars safe at all times.

We’d advise them to invest in a car signal blocking ‘Faraday’ pouch or have the keyless entry system deactivated. Some car makers have come up with alternative solutions to the problem of car theft. For example, Tesla has added a PIN number to the infotainment system to all new and many second-hand models; the cars can’t be driven until the correct code has been entered.

Vauxhall told us that keyless entry technology is not available on almost all of its new cars. Kia, meanwhile, said its research and design department is working on new technology for key fobs or improvements to the security of key fob codes. In the meantime, it’s providing a Faraday bag free with every new car purchased and enabling dealerships to sell the pouches to existing owners at a discounted price of £10.

However, more needs to be done to improve security on many new and used cars with keyless entry and start systems.