How W5 ‘stole’ a car with a device we ordered online

This is part two of a three-part investigative series from CTV W5 on how car thieves can drive away with modern vehicles so easily. W5 correspondent Jon Woodward ordered a device flagged by police and used it to clone a car key.

A device that can be used to clone a car’s key fob and drive away without the owner’s help can be ordered online, delivered within days and deployed within an hour, according to research by W5.

How do we know that? Because we did it.

And the demonstration illustrates what some say is an ongoing security failure, even as governments, law enforcement agencies and insurance companies rush to block a wave of thefts that totaled some $1.5 billion last year.

“I think we’re facing a crisis in this country,” said Elliott Silverstein of the Canadian Automobile Association, pointing to figures showing more than 70,000 vehicles will be stolen across Canada in 2023.

“You think of a natural disaster, like a flood, a hurricane or a fire, and imagine it happening every day of the year with no end in sight. That’s the problem with car theft in Canada right now,” Silverstein said.

The federal government has adopted new regulations to restrict certain radio equipment that can be used for car theft, following a national summit earlier this year. Figures from insurance research group Equite Association show that car theft has fallen by 17 percent this year.

But during a consultation on whether to restrict devices used by thieves, York Regional Police highlighted brands of major reprogrammers that they say are also used in car thefts.

A thief uses a tablet to gain entry to a vehicle in surveillance video obtained by W5

Those are the devices seen in some surveillance videos, showing thieves huddled over their tablet screens, usually connected by a cable to the car’s computer.

They can also be used legitimately by car owners who are looking for new keys or to repair defects in their vehicle.

• Part One: How Did Thieves Stole Your Car? Maybe with a device they ordered online

The federal government told us they were restricting certain devices, but these important programming devices seemed to be widely available. So that’s what W5 decided to order.

Our device cost about $835.07 through online retailer Amazon.ca and was sold by a Chinese company.

It arrived within a few days in a black plastic carrying case with an accessory that allowed it to be connected to the car, as well as two universal key fobs.

The device W5 ordered walked the user through the steps to clone a key – even though the original car key was nowhere around

Once loaded, we were able to download files corresponding to a variety of car models, including Ford and Chevrolet. The operating system provided instructions on next steps.

W5 isn’t going to explain exactly how we used it. When we tried it on two vehicles in the CTV fleet, the key fobs were nowhere around.

The first attempt, on a Chevrolet SUV with push-button ignition, didn’t work. The device gave error messages that it could not connect to the Internet.

However, on another CTV vehicle, a Ford SUV with a push-button ignition, our device went through all the steps and paired one of those universal key fobs to the car.

With that newly programmed key in the cabin of the Ford, the car started and I was able to drive away.

W5 reporter Jon Woodward used a tablet ordered online to investigate concerns raised by police about certain car key cloning devices

“These devices are out there, and this is a problem,” Silverstein said. “Is this the same as having lock picking tools for sale on the Internet?”

We’ve reached out to Ford with specific details of the demonstration. A company spokesperson, Matt Drennan-Scace, told us that our demonstration did not reflect real-world conditions because the car doors were initially unlocked and we did not set off any alarms in the car.

But locksmith and engineer Yaser Jafar, who uses the devices legally as part of his Hamilton-based company Auto Key Pro, said in his experience these devices can be used in those scenarios as well.

“The thieves unfortunately have the exact same tools and perform the exact same steps to steal the cars there,” Jafar said.

Amazon has said that all devices for sale on its site are legal there, although even legal devices can be misused.

Manufacturer: Devices are ‘not for illegal activities’

The device manufacturer, New York-based Autel, said in a statement to W5 that it is aware that important reprogramming tools have been found in the possession of people involved in vehicle thefts, and that it is working with US authorities who wish to ask questions about its technology. .

“Our immobilizer and key programming tools are designed for professional locksmiths to expand their repair service capabilities, not for illegal activities,” said spokesperson Allison Whitney.

“We have improved the technical capabilities of our products to prevent misuse, including the integration of two-factor authentication. We are exploring other solutions, such as working with third-party accreditation service providers,” Whitney said.

“The solution to reduce car theft is complex. It will take the combined efforts of all parties involved – automakers, professional tool developers, law enforcement, policymakers and the driving public – to achieve significant change. Autel wants to be part of that solution,” she said.

Scace said Ford considers security a top priority and is rolling out new devices to keep cars safe.

It launched “Stolen Vehicle Services” for Ford F-Series trucks in 2024, with a dedicated track featuring live agents who connect with law enforcement to track and recover stolen vehicles, Scace said.

The 2025 F-Series trucks offer the “Ford Security Package,” in which vehicle owners receive theft alerts and can remotely disable their truck through the FordPass app, even if someone has an authorized key nearby, he said.

“Over time we will expand these features to other Ford vehicles,” he said.

Another product that can be used to block this device’s access is offered by mechanic Ryan Jaipal of Durham Autohaus in Pickering, Ont.

Jaipal says he has customers call every day to make sure the car they’re replacing isn’t as vulnerable as the car that was stolen.

“This customer has already had his vehicle stolen twice,” Jaipal said, pointing to a Porsche 911 in his shop. “I can’t even count how many calls and emails I get a day.”

He recommends the Igla, a small device that can be installed in a car and requires a password to get the car moving.

With that installed, the device can clone a key, but it would be useless unless the driver also entered their password.

Silverstein, of the CAA, said he thinks the federal government should consider restricting the device we ordered, and also called on automakers to improve the safety of their vehicles.

“It doesn’t take long to use these tools to access the cars,” he said. “And given that manufacturers have not tightened safety standards enough, consumers are vulnerable.”

For tips on car theft or another story, email Jon Woodward.