Most of the UK’s most popular cars are at risk of theft using technology that exploits keyless entry, according to a report.
The Ford Fiesta, Volkswagen Golf, Nissan Qashqai and Ford Focus – four of the top five models sold in the UK – are among the cars that are susceptible to theft using “cheap electronic equipment bought online”, the consumer group Which? said.
Keyless entry systems enable cars to start if a fob is nearby. However, thieves using relay devices to boost the signal can trick the cars’ sensors into thinking the keyless fob is closer than it is, enabling them to open and start a vehicle even when the fob remains in the owner’s house.
Cars tested by ADAC that were vulnerable to unlock and engine start
Alfa Romeo
Giulia (2016), Stelvio (2017)
Audi
A3 (2015), A3 (2017), A4 (2015), A4 Avant (2015), A4 Avant g-tron (017), A5 (2016), A5 Cabrio (2016), A6 (2014), A6 allroad (2012), A8 (8/2017), Q2 (2016), Q7 e-tron (2017), R8 (2015), S5 Sportback (2016), SQ7 (2016), TT RS (2016), TTS (2014)
BMW
218d (2018), 225xe (2016), 230i (2017), M240i Coupe (2017), 318i (2015), 318d (2016), 320i (2017), 440i Grand Coupe (2017), 520d (2016), 520i (2017), 520d (2018), 530d Touring (2017), 630 GT (2017), 640d (2016), 730d (2015), 730d (2017), 740 (2015), 740d (2016), i3 94 Ah (2016), i3 94 Ah (2016), i3 (2017), i8 Roadster (2018), X1 (2015), X1 SDrive 18d (2016), X1 18d (2018), X2 (2017), X3 (2017), X3 xDrive 20i (2018), X4 xDrive 30i (2018)
Chevrolet
Camaro (2017)
Citroen
DS4 CrossBack (2015), C3 Pure Tech (2016), C4 Picasso (2014), C4 Picasso HDI (2014), Spacetourer (2016)
DS Automobiles
DS7 (2017)
Fiat
124 Spider (2016), 500x (2017)
Ford
Eco-Sport (2015), Eco-Sport 1.5 (2018), Edge (2016), Fiesta (2017), Fiesta (2017), Focus RS (2016), Galaxy (2014), Kuga Vignale (2017), Mustang (2015), S-Max (2015)
Honda
Civic (2018), HR-V (2015)
Hyundai
i10 (2016), i20 (2018), i30 (2015), i30 (2017), i30 1.4 T-GDI (2017), i30 (2018), i40 (2016), loniq (2017), loniq (2017), iX35 Fuel Cell (2015), Nexo (2018), Kona (2018), Kona 1.0 T-GDI (2017), Santa Fe (2015), Tucson 1.6 (2018)
Jaguar
F-Pace (2016)
Jeep
Compass (2017)
Kia
Ceed (2018), Ceed 1.6 CRDi (2018), Niro Hybrid (2016), Optima (2015), Optima (2016), Optima Plugin-Hybrid (2016), Optima (2018), Optima (2018), Rio 1.0F GDI (2017), Sorento (2017), Sportage CRDI (2017), Sportage 2.0 CRDI (2018), Stinger (2017), Stonic 1.0 (2017)
Land Rover
Discovery (016), Range Rover Evoque (2015)
Lexus
CT 200 (2017), RX 450h (2015)
Mazda
3 Skyactive (2016), 3 Skyactive (2016), 6 (2018), CX-5 (2015), CX-5 (2017), MX-5 (2017),
Mercedes
A 200 AMG (2018), C 220D (2018), C 200 (2018), E 200 Cabrio (2017), E 220d (2015), E 220d T-Modell (2016), E 400 Coupe (2017), E 400d AMG (2017), S 400d (2017)
Mini
Clubman (2015), Cooper S Cabrio (2016), Cooper Countryman (2017), One 2018)
Mitsubishi
Outlander (2016), Outlander (2013), Space Star (2016)
Nissan
Leaf (2012), Leaf (2016), Leaf (2018), Micra (2017), Navara (2016), Qashqai (2016), Qashqai+2 (2013), Qashqai 1.6 dCi (2017)
Opel
Ampera (2012), Ampera E (2017), Astra (2016), Crossland X 1,2 DI (2017), Grandland 1.2 DI (2017), Grandland X (2018), Insignia Grand Sport (2017), Insignia 1.5 (2017), Insignia Sports Tourer (2017), Insignia (2017)
Peugeot
308 SW 2.0 (2017), 508 SW (2012), 5081.6 (2018), 3008 (2016), 5008 BlueHDi 150 (2017)
Renault
Captur (2016), Captur TCe 120 (2017), Clio (2016), Grand Scenic (2017), Kadjar (2015), Kadjar (2017), Koleos (2017), Megane (2016), Megane Grandtour (2016), Scenic (2016), Scenic (2017), Talisman (2015), Talisman Grandtour (2016), Traffic (2015), Zoe (2016)
Seat
Arona (2017), Ateca (2016), Ibiza (2017), Leon 1.4 TSI (2016), Leon (2017)
Skoda
Karoq 1.5 TSI (2017), Kodiaq (2016), Octavia (2015), Octavia (2016), Octavia 1.4 TSI (2017), Octavia 1.5 TSI (2018), Octavia Combi RS (2017), Rapid Spaceback (2017), Superb 1,6TDi (2015)
SsangYong
Rexton (2017), Tivoli XDi (2015)
Suzuki
Baleno (2016), Ignis (2018), Swift (2017), Swift Sport (2018), SX4 S-Cross (2016), Vitara (2015)
Subaru
Forester 2.0 D (2017), Impreza (2017), Levorg (2015), Outback (2018), XV (2017)
Tesla
Model S P85 (2014), Model X (2017)
Toyota
C-HR 1.8 Hybrid (2016), C-HR (2016), Mirai (2016), Prius (2007), Prius 1.8 Hybrid (2016), Prius Plug-in-Hybrid (2017), RAV4 (2015), Verso (2015)
Volvo
V40 (2016), S90 (2016), S90 D5 (2016), V60 (2018), V60 D3 (2018), V90 D5 (2016), V90 D3 (2018), V90 D4 (2018), XC 40 (2018), XC 40 (2018), XC 60 (2017), XC 90 T8 (2016)
Volkswagen
Arteon 2.0 TDI (2017), eGolf (2017), Golf 7 TSI (2015), Golf 7 Variant 1.4 TSI (2015), Golf 7 1.5 TSI (2016), Golf 7 GTD (2013), Golf 7 GTD (2016), Passat 2.0 TDI B8 (2016), Passat GTE B8 (2016), Passat (2018), Tiguan AD1 (2016), Tiguan AD1 (2016), Tiguan Allspace (2017), Touran 5T (2015), Touareg 3.0 V6 (2018)
Motorcyles
BMW R 1200 RS (2016), Ducati Multistrada 1200 D-air (2017), KTM Super Duke R (2017)
Keyless start only
BMW i3 (2014), Volvo XC 60 T5 (2017), Mazda 2 Skyactive 90 Kizohu (2018)
Keyless open only
Infiniti Q30 (2016)
Not vulnerable to unlock or engine start
Jaguar i-Pace (2018), Land Rover Discovery (2018), Land Rover Range Rover (2018)
Which? analysed data from the German General Automobile Club (ADAC) which found security flaws in 99% of the models tested. It tested 237 keyless cars and found only seven were not susceptible to being both unlocked and started.
Only three models – all from Jaguar Land Rover – were completely impervious to attempts to unlock or start their engines. The latest versions of the Land Rover Discovery and Range Rover, as well as the Jaguar i-Pace, use technology that can more accurately determine the distance from the car.
ADAC found more than 30 brands have made insecure cars, including Audi, BMW, Honda, Hyundai, Kia, Peugeot, Renault, Skoda and Volvo.
Of the top five models sold in the UK, only the Vauxhall Corsa was not vulnerable to the relay attack, because it is not available with keyless entry.
“Carmakers have sacrificed the security of scores of modern cars for the sake of convenience,” Which? said.
“Thieves have been using the relay attack for several years. But the number of vehicles that can be stolen in this way has rocketed because many manufacturers have done nothing to protect their cars from this attack.”
Mike Hawes, the chief executive of the car industry’s Society of Motor Manufacturers and Traders, said: “Industry takes vehicle crime extremely seriously and any claims otherwise are categorically untrue. New cars are more secure than ever, and the latest technology has helped bring down theft dramatically with, on average, less than 0.3% of the cars on our roads stolen.
“We continue to call for action to stop the open sale of equipment with no legal purpose that helps criminals steal cars.”
Which? found it can take as little as 18 seconds to take a car using the relay method.
Ford, one of the manufacturers contacted by Which? for comment on the findings, advised owners to keep their fob in a metal case to prevent thieves from hijacking the signal. Some Mercedes, Mazda and Peugeot owners can have the keyless entry system turned off.
BMW and Mercedes have also introduced motion sensors in their keyless fobs, meaning no signals are sent if they are not moving.
