Key emulators, CAN injection, and the technology arms race between criminals and manufacturers…
Vehicle theft in the UK is no longer just about jamming a signal or picking a lock. A new generation of devices is now able to bypass a car’s security systems entirely and it’s changing who gets targeted and how fast a vehicle disappears.
There is a device that steals your car in seconds – small enough to fit in a jacket pocket, disguised to look like a Nintendo Game Boy or other every day item such as a speaker or C02 sensor – that can open your car door and start your engine. No key. No forced entry. No trace. Meanwhile, others in circulation can be mistaken for powerbanks, legitimate OBD readers and even portable speakers.
Key emulators have been circulating in organised crime networks for several years. What has changed is accessibility. Our director Ahron Tolley said:
“Devices once priced in the tens of thousands of pounds – the exclusive tools of highly skilled, well-funded criminal groups targeting luxury vehicles are now available for a fraction of that cost, operated by individuals with no technical background whatsoever. The barrier to entry has collapsed. The threat has scaled accordingly.”
Electronic security alone can no longer be relied on to keep a vehicle where you left it, which is why more owners and fleets are pairing it with GPS tracking devices and professional vehicle tracking monitoring as a second line of defence.
Modern vehicles use a keyless entry system that continuously scans for a legitimate key signal. When you touch the door handle, the car wakes up and looks for that signal. A key emulator intercepts that moment – it responds to the car’s query with a cloned or synthesised signal that satisfies the security check. The car unlocks. The engine starts. The thief drives away.
This is a different attack to the relay theft most drivers have heard of, which relies on capturing and amplifying a real key’s signal from a distance. For a detailed look at how that works and how to protect against it, read our guide to Keyless Car Theft: How Relay Attacks Work & How To Protect Your Vehicle.
The more technically sophisticated variant is the CAN (Controller Area Network) injection attack. Every modern vehicle runs an internal communications network – the CAN bus – connecting all of its electronic control units (ECUs). It was designed in the 1980s for efficiency, not security. Messages sent across it are trusted implicitly; the system has no mechanism to verify whether a message is legitimate or fabricated.
Criminals exploit this by accessing the CAN bus through the vehicle’s headlight assembly – removing or partially dismantling it to reach the wiring harness connected to the network. A device is then plugged in, sometimes concealed inside a Bluetooth speaker or USB stick — that injects fraudulent messages directly into the vehicle’s system. Those messages instruct the car to unlock its doors and disable its immobiliser. The car, trusting its own network, complies.
Critically, this method does not require the original key to be nearby. Faraday pouches don’t solve every vehicle theft risk. While they can help protect against relay attacks, CAN injection is a different type of attack that targets the vehicle’s internal electronic systems – which is why stolen vehicle recovery matters as a backstop regardless of how the theft happened.
Metropolitan Police estimates place electronic devices – signal jammers, relay amplifiers, and emulators as a factor in approximately 40% of vehicle thefts nationally, rising to 60% in London. These are not fringe tactics. They are the dominant method.
In September 2025, the Metropolitan Police convicted four members of an East London gang responsible for 73 vehicle thefts across the capital. The group operating a stolen-to-order model, with customers specifying makes and models and used key emulators to target Hyundai, Kia, Mitsubishi, and Toyota vehicles. Key emulators were recovered at the point of arrest. A number of the stolen vehicles are believed to have been exported overseas.
In Essex, an OCG targeting Mercedes, BMW, Toyota Hilux, and Range Rover vehicles across South Essex between January and June 2024 resulted in three men being sentenced to a combined 11.5 years. At least 50 high-value vehicles with a combined value of £1.5 million were stolen. In the South of England, eleven arrests were made following the theft of approximately 40 keyless vehicles worth an estimated £500,000 – with investigators believing the vehicles were exported overseas.
The stolen-to-order model appears consistently across investigations. These are not opportunistic thefts. They are commissioned crimes, with a supply chain that extends well beyond the individual stealing the vehicle. If you’re ever unlucky enough to need it, our guide on reporting a stolen vehicle covers exactly what to do first.
The original devices were manufactured by specialists and carried price tags to match — often in the tens of thousands of pounds. What has fundamentally changed is the source. Cheaper copycat versions, manufactured at scale in factories across China, have driven costs down to as little as £1,000 in some cases. This isn’t a niche criminal tool any more. It’s a commodity.
That price collapse has two direct consequences. First, it lowers the threshold for entry into vehicle crime – criminals who previously lacked the capital or connections to access this technology can now acquire it with relative ease. Second, it broadens the target pool. Devices once reserved for high-value luxury vehicles have been updated to cover volume brands and electric vehicles. The Hyundai Ioniq 5 and Kia EV6, both modern EVs with sophisticated keyless systems, have both been successfully targeted – a trend we cover in more depth in our guide to electric vehicle theft.
High-end devices capable of CAN injection have been seized at values exceeding £20,000 and intelligence indicates these are treated as business assets within OCGs, shared and rented between networks rather than purchased per-job. But with commodity versions now circulating at a fraction of that price, the shared-asset model may itself be evolving. Wider availability means wider distribution. Wider distribution means wider exposure.
These devices are traded online, including on dark web marketplaces, and openly listed on certain platforms with vehicle compatibility catalogues – effectively product listings for theft tools.
The UK government has moved to criminalise possession of these devices, with those found in possession, or found to have imported, manufactured, adapted, or distributed them, facing up to five years’ imprisonment and an unlimited fine. Notably, the legislation also shifts the burden of proof – an important development given the difficulty of proving intent in possession cases.
Whether enforcement will match the legislation remains to be seen. RUSI’s 2025 report on organised vehicle theft noted that the UK’s export controls remain significantly under-resourced, with insufficient officers and analysts to provide systematic oversight – meaning stolen vehicles continue to flow across borders with limited friction.
Manufacturers are aware. Some are implementing hardware security modules – cryptographic systems that require messages on the CAN bus to be verified before being acted upon, a so-called “zero trust” approach to internal vehicle communications. Ultra-wideband technology, which measures the precise distance of a key rather than simply detecting its signal, is being adopted in newer models as a defence against relay attacks. Tesla’s optional PIN-to-drive feature appears to provide meaningful resistance to emulator-based theft.
But the retrofit problem is significant. The hundreds of thousands of vehicles already on UK roads with vulnerable keyless systems cannot be retrospectively secured through a software update alone. For the foreseeable future, a substantial proportion of the UK vehicle fleet remains exposed – and with commodity emulators now widely available, the window for manufacturers to get ahead of this is narrowing fast. Professional GPS installation is one of the few ways owners of older, unprotected vehicles can close that gap themselves.
For private owners this means volume brands and EVs can no longer be treated as lower-risk by default. For fleet operators and insurers, it means risk assessments built around older relay-attack assumptions need updating — a device that bypasses electronic security entirely changes what “secure” actually means for a vehicle sitting on a forecourt or in a depot overnight.
No single measure stops every method on this list – that’s the point. Layering physical deterrents with electronic ones gives you the best chance both of preventing a theft and, if the worst happens, of getting the vehicle back.
A GPS tracking device doesn’t stop a key emulator or a CAN injection attack at the point of theft, but it’s what gives you a realistic chance of recovering the vehicle afterwards. Our private vehicle tracking solutions are built around exactly this scenario. If your vehicle has already been taken, here’s what to do if it’s stolen.
Contact us today at 020 3834 3123 or email us at info@track-recovery.com or more information.