Car Theft Group Test - Britain's Most Secure Cars
With car theft an ongoing problem, we tested seven car security systems to find out how easy it is to get into them and drive away without consent...
The UK is in the midst of an ongoing car theft epidemic. More than 104,000 vehicles were reported stolen in 2023 – the first time thefts have topped 100,000 since 2009. Those figures are up by 21% up on 2022, when 86,000 thefts occurred, and they're a worrying 43% up on 2012.
One reason for the high number of thefts is believed to be the now-widespread availability of keyless entry systems on cars. A spokesman for the ABI says: “The fact that you’re unable to know exactly how the vehicle was stolen unless it is recovered [which happens in a minority of cases] means it is difficult to specifically attribute a numerical ‘extent’ to which keyless systems have caused the rise, but insurers and the police agree that the increase in the number of keyless vehicles on the road has played a big role, particularly because they tend to be higher-end vehicles.”
How we tested car security
To find out how vulnerable keyless entry and start systems make cars to theft, we asked two security experts – Ron Cliff and Voskan Pehlivanjan from Edilock – to use any non-damaging technology to gain access to seven cars with keyless entry.
In five instances, our fake thieves used a form of entry that’s often referred to as a relay attack. It involves two electronic devices – one to pick up the signal from the key fob and a booster unit that repeats the code next to the car door to open it. On two of the cars, they used a lock-picking device to unlock the doors.
We measured the time it took them to gain entry to each car and the time to start the engine, and combined these two to give us a total theft time so we could compare them.
In general, keyless entry fobs have a range of five to six metres, so one of the scanner units has to be no farther than this from the fob. The distance between the two scanners can be up to 50 metres, though, so don’t think that your car is safe just because the keys are a fair distance from it; if a thief can get close to the fob, the car is vulnerable.
Our tests revealed that it can be 90% faster to steal a keyless entry car than a car with old-fashioned locks and ignition – in as little as 10 seconds. That compares with the two and a half minutes the security experts said it would take them to get into a car without keyless entry.
When the additional security features were working on all relevant cars, they were able to drive off in two of the seven cars in 60 seconds or less.
When the extra security measures weren’t working, they could steal six out of the seven cars in this time. The only car they couldn’t start was the Land Rover Discovery, which has ultra-wideband radio technology.
Keyless entry vs standard remote control key fobs
For our security test, we asked 30 car makers to provide us with their most secure car. Most either didn’t reply or told us they didn’t want to be included in the test, while two – Suzuki and Kia – provided us with models without keyless entry systems: a Vitara 1.0 SZT 4WD and a Sorento 2.2 CRDi KX-2. Our security experts agreed that these cars were more secure than keyless entry models.
They said results from previous tests done by security experts show they would be able to steal both of them in 2min 30sec. However, to do so, they would have to set off the car alarms and damage the steering columns to bypass the ignition and hotwire them. This makes them a far less appealing target for thieves, who are generally opportunistic and looking for the easiest and quickest cars to steal.
Audi TT RS Roadster - not stolen
Advanced Key inactive: Get into car Not possible Drive away Not possible
Advanced Key active: Get into car 5sec Drive away 5sec
The TT RS Roadster doesn’t come with keyless entry as standard; without it, it’s harder to get into than when it’s specced with the £1495 Comfort and Sound Pack, which includes the Advanced Key keyless entry system. The optional fob has a motion sensor, but it can’t be put to sleep immediately and doesn’t cut in until the fob has been motionless for 15 minutes. We believe this would prevent thieves from taking the car from a driveway at night. However, with the key fob awake, our fake thieves could drive away in the TT in just 10 seconds.
In response, Audi’s parent company, the VW Group, said: “We are continually working on improving our security measures in order to hinder or prevent such manipulation. We closely observe how thieves work and discuss this topic with police authorities and insurers.”
Read our review of the 2014-2024 Audi TT Coupe, or see the best deals on used Audi TTs
BMW X3 xDrive20i M Sport (2018 model) - not stolen
Digital smart key inactive: Get into car Not possible Drive away Not possible
Digital smart key active: Get into car 40sec Drive away 20sec
BMW declined to provide us with a car for our test, so we sourced one elsewhere. Our X3 has a digital smart key with motion sensor technology – part of a Technology Pack that’s standard with Sport trim. BMW told us that the Comfort Access system on the smart key has a “security system that automatically cuts off the signal emitted from the key when it has been stationary for a set amount of time”.
We believe this is two minutes; the key cannot be activated immediately. However, when the motion sensor technology hasn't cut the signal the key's code can still be picked up and we were able to steal the X3 in 60 seconds. When the motion sensor technology is working, this would prevent the car from being stolen.
A spokesman also said all new BMW and Mini keyless entry keys now have motion sensor technology as standard. “Every single case we are aware of where a relay attack method has been used is when the key is left unattended and not in a pocket – hence our approach to the solution.” He added that owners of many older BMW models can pay to have the motion sensor technology retrofitted; the price of this differs between models.
Read our review of the 2010-2018 BMW X3, or see the best deals on used X3s
DS 3 Crossback Puretech 155 Ultra Prestige - stolen in 10sec
Get into car 5sec Drive away 5sec
The range-topping DS 3 Crossback Ultra Prestige trim level comes with keyless entry as standard. The car’s flush-fitting door handles popped out to give our thieves access after just five seconds. It was also easy for them to repeat the code to start the engine using the push-button starter.
The PSA Group, the parent company of DS, responded by saying: “PSA Group has created a dedicated division to analyse and treat potential or proven weaknesses of vehicle security, including to monitor statistics and internet activity. PSA Group works closely with the police and regulatory authorities in order to analyse theft methods.” It also said the keyless entry systems on the latest cars could be deactivated by dealers if owners were concerned.
Read our review of the DS 3, or see the best deals on a DS 3
Ford Fiesta 1.0 Ecoboost 140 ST-Line X - not stolen
Sleeping key fob inactive: Get into car Not possible Drive away Not possible
Sleeping key fob active: Get into car 40sec Drive away 20sec
The Fiesta comes with a ‘sleeping key fob’ with a motion sensor inside that makes it inactive when it hasn’t been moved for 40 seconds. The sleeping key fob prevented our thieves from getting into the car when it had been untouched for the specified time, but the moment it was moved, they were able to grab its code and open the car doors. The sleeping key fob has recently been made standard equipment on all new Fiesta and Focus models.
The company says these key fobs will be rolled out across the entire car and van range in due course. Owners of current Fiesta and Focus models can buy a new key fob for £62 and £72 respectively, plus 0.9 hours’ labour to program and test the key.
Alternatively, owners of the latest Ford models can disable the keyless entry function via the car’s steering wheel-mounted controls.
Read our review of the 2017-2023 Ford Fiesta, or see the best deals on used Fiestas
Land Rover Discovery SD6 306 HSE - not stolen
Get into car 20sec Drive away Not possible
Our thieves chose to use a lock picker to open the Discovery’s driver’s door, setting the car’s alarm off. And they weren’t able to start the engine, because the car was fitted with ultra-wide-band radio technology, which transmits over a wide range of frequencies at once to stop thieves from being able to pick up the signal.
Read our review of the Land Rover Discovery, or see the best deals on a Discovery
Land Rover Discovery Sport TD4 180 HSE (2018 model) - stolen in 30sec
Get into car 10sec Drive away 20sec
We tested a second Land Rover model because Jaguar Land Rover hasn’t chosen to add ultra-wide-band radio technology to all of its models, and we don’t believe the Discovery Sport has this added security. As with the Discovery, our thieves used a lock picker to get into the Discovery Sport. They were then able to plug a device into the car’s onboard computer to get the necessary code to re up the engine via its push-button starter.
Land Rover declined to comment on our tests of the Discovery and Discovery Sport.
Read our review of the Land Rover Discovery Sport, or see the best deals on Discovery Sport
Mercedes A-Class A220 AMG Line - not stolen
Keyless-Go key fob inactive: Get into car Not possible Drive away Not possible
Keyless-Go key fob active: Get into car 30sec Drive away 20sec
The A-Class has a Keyless-Go keyless entry fob, which can either be deactivated immediately by pressing a button or will turn itself off when it’s been motionless for two minutes. We believe this technology would protect the car from theft when it’s parked on a driveway late at night. However, when the motion sensor hasn’t kicked in or the fob manually deactivated, the car could be stolen in less than one minute.
A spokesman for Mercedes said: “All our Keyless-Go keys can be switched off by pressing the locking button on the key twice and the latest generation of Keyless-Go keys are equipped with a built-in motion sensor. This means that if the key is motionless – for example, in a drawer or on a hook – after two minutes, no Keyless-Go signals are sent out and the signals from the key cannot be hijacked.”
Read our review of the Mercedes A-Class, or see the best deals on an A-Class
What do the results mean?
"It’s outrageous that some car makers have introduced keyless entry and keyless start systems without making them anywhere near as secure as the traditional alternatives they’ve replaced. Criminals are able to circumvent the other security systems on these cars, such as alarms and immobilisers, by hacking into their codes," comments Claire Evans, consumer editor with What Car.
"It is great news that a number of brands have introduced sleeping keyfobs, fitted with motion sensor technology, to combat theft. Some brands have introduced ultra-wideband technology, which works effectively to stop car keys being hacked, and Audi, BMW and Land Rover have gone further, introducing key emulation and CAN bus protection.
"We particularly applaud the Jaguar Land Rover Group for actively aiming to stop criminals in a number of ways. It is retro-fitting older models with technology that makes them far harder to steal, and it is working with the police to target organised crime groups."
About the report author
Claire Evans has been a motoring journalist for more than 30 years, working on consumer issues for a great deal of that time. After a stint as the advice columnist for Carweek magazine in the 1990s, she also spent six years working on motoring content for Which?. It is here she oversaw the running of the charity's annual used car reliability survey.
Claire launched the What Car? Reliability Survey in 2017, and since then has helped thousands of buyers choose the most reliable new cars and SUVs, as well as the most dependable used cars.
For all the latest reviews, advice and new car deals, sign up to the What Car? newsletter here
