Car security investigation: How W5 'stole' a car using a device we ordered online

W5: How Thieves Steal Your Car | Part Three W5's Jon Woodward joins York Regional Police during a bust on an operation they believe smuggles vehicles from Canada to an African port.

This is part two of a three-part investigative series by CTV W5 into how car thieves are able to drive off with modern vehicles so easily. W5 correspondent Jon Woodward ordered a device that had been flagged by police and used it to clone a vehicle key.

A device that can be used to clone a car’s key fob and drive it away without the assistance of the owner can be ordered online, delivered within days and put to use in under an hour, a W5 investigation has found.

How do we know? Because we did it.

And the demonstration illustrates what some say is an ongoing security flaw, even as governments, law enforcement agencies and insurance companies rush to block a wave of thefts that totalled some $1.5 billion in value last year.

“I think we have a crisis on our hands in this country,” said the Canadian Automobile Association’s Elliott Silverstein, pointing to figures that show more than 70,000 vehicles were stolen across Canada in 2023.

“You think about a natural disaster, like a flood or a hurricane or a fire, and imagine it happening every day of the year without any end in sight. That’s what the auto theft issue is right now in Canada,” Silverstein said.

The federal government has passed new regulations to restrict some radio devices that could be used for car theft, after a national summit earlier this year. Figures from insurance investigative group Equite Association show auto theft has dropped 17 per cent this year.

But during a consultation on whether to restrict devices thieves used, the York Regional Police Service brought up brands of key reprogrammers that they say are also used in car thefts.

Those are the devices that can be seen on some surveillance videos, with thieves huddled over their tablet screens, usually with a cable plugged into the car’s computer.

They can also be used legitimately by car owners looking to get new keys or find faults with their vehicles.

The federal government told us they did restrict some devices – but those key programmer devices appeared to be widely available. So that’s what W5 decided to order.

Our device cost about $835.07 through online retailer Amazon.ca, and was sold by a Chinese company.

It came in a few days, in a black plastic carrying case with an accessory that allowed it to plug into the car, as well as two universal key fobs.

Once charged, it allowed us to download files corresponding to a variety of car models, including Ford and Chevrolet. Its operating system offered instructions about next steps.

W5 is not going to explain exactly how we used it. When we tried it on two vehicles in the CTV fleet, the key fobs were nowhere nearby.

The first try, on a Chevrolet SUV with a push-button ignition, didn’t work. The device offered error messages saying it couldn’t connect to the internet.

However, on another CTV vehicle, a Ford SUV with a push-button ignition, our device went through all of its steps, and one of those universal key fobs became matched to the car.

With that newly programmed key inside the Ford’s cab, the car started and I could drive it away.

“These devices are out there, and this is a problem,” said Silverstein. “Is this like having lock picking tools for sale on the internet?”

We contacted Ford with the specific details of the demonstration. A company spokesperson, Matt Drennan-Scace, told us our demonstration didn’t reflect real world conditions, because the car doors were initially unlocked and we hadn’t set off an alarm in the car.

But locksmith and engineer Yaser Jafar, who uses the devices legally as part of his Hamilton-based company Auto Key Pro, said in his experience those devices can be used in those scenarios as well.

“The thieves, unfortunately, have their hands on the same exact tools, are doing the same exact steps to be able to steal the cars out there,” Jafar said.

Amazon has said that all devices for sale on its site are there legally, though even legal devices can be misused.

Manufacturer: Devices are 'not for illegal activities'

The device manufacturer, New York-based Autel, said in a statement to W5 that it’s aware that key reprogramming tools have been found in the possession of people involved in vehicle thefts, and it’s co-operating with American authorities looking to ask about its technology.

“Our immobilizer and key programming tools are designed for professional locksmiths to expand their repair service capabilities, not for illegal activities,” spokesperson Allison Whitney said.

“We have been enhancing the technical capabilities of our products to prevent their misuse, including integrating two-factor authentication. We are exploring other solutions, such as co-operating with third-party accreditation service providers,” Whitney said.

“The solution to reducing vehicle theft is a complex one. It will require the concerted efforts of all involved parties—automakers, professional tool developers, law enforcement, policymakers, and the driving public—to realize significant change. Autel is committed to being part of that solution,” she said.

Scace said Ford considers security a top priority and said it’s rolling out new devices to keep cars secure.

It launched “Stolen Vehicle Services” for Ford F-Series trucks in 2024, which featured a dedicated number with live agents who connect with law enforcement to track and recover stolen vehicles, Scace said.

The 2025 F-Series trucks offer the “Ford Security Package,” where vehicle owners receive theft alerts and can remotely disable their truck via the FordPass app, even if someone has an authorized key nearby, he said.

“In time, we will be expanding these features to other Ford vehicles,” he said.

Another product that could be used to block access by this device is offered by mechanic Ryan Jaipal of Durham Autohaus in Pickering, Ont.

Jaipal says he gets customers calling every day looking to make sure the car they replace isn’t as vulnerable as the car that was stolen.

“This client had his vehicle stolen twice already,” Jaipal said, gesturing to a Porsche 911 in his shop. “I can’t even count how many calls and e-mails I get a day.”

He recommends the Igla, which is a small device that can be installed within a car that requires a password to put the car in drive.

With that installed, the device could clone a key, but it would be useless unless the driver also entered their password.

Silverstein, of the CAA, said he thinks the federal government should consider restricting the device that we ordered, and also called for car manufacturers to improve security on their vehicles.

“It doesn’t take very long to use these tools to get access to the cars,” he said. “And given the fact that manufacturers have not tightened security standards enough, consumers are vulnerable.”

For tips on car theft, or any other story, please email Jon Woodward