Have a car with a push-to-start ignition? Here's how it could end up stolen and overseas
Marketplace investigation finds stolen cars from Ontario and Quebec in Nigeria’s used car lots
Cars stolen from Ontario and Quebec are openly being advertised and sold in West African countries, including Nigeria and Ghana, according to a Marketplace investigation, which also found thieves are targeting vehicles with push-to-start ignitions.
Stolen vehicles are being shipped overseas by thieves so audacious, they leave behind takeout containers, identifiable bumper stickers and even licence plates.
Experts say that car companies prioritizing convenience over security with those push-to-start ignitions allow thieves to quickly and easily steal vehicles to ship overseas, where demand for Canadian cars is high because of their reliability and the availability of parts, and the consequences for thieves are low.
"It's low risk, high reward," said Det. Greg O'Connor of the Peel police auto crime unit, who told Marketplace this type of car theft has a low overhead cost and takes little time. Cars can be loaded onto shipping containers and be en route within hours, he said.
Police in Peel Region, west of Toronto, say that 80 to 85 per cent of stolen vehicles are tied to organized crime and destined to be shipped overseas, many to West Africa.
Other stolen vehicles can be given a new, fake vehicle identification number (VIN) and resold within Canada, or used to transfer drugs, guns or for human trafficking.
"This isn't a victimless crime," said O'Connor.
Marketplace was able to find stolen Canadian vehicles in Ghana and Nigeria. On the website Jiji, an online marketplace similar to Kijiji, vehicles that are foreign-owned are heavily advertised, and the cars can sell for nearly double the cost they would go for in Canada. A 2018 Lexus RX 350 was listed for sale for 28,000,000 Naira, or about $85,000 Cdn. That same vehicle with similar mileage has a market price of around $48,000 on Autotrader.ca.
Some sellers don't even remove Ontario licence plates or Canadian dealership stickers. One image from Ghana in 2017 shows cars with Ontario licence plates advertised along the main road. In February, researchers were able to find a 2018 Lexus RX 350 on a used car lot in Lagos, Nigeria. The vehicle had undergone a safety inspection in Niagara Region, in southern Ontario, in August 2021. CBC cannot confirm when it was stolen.
How it's done
You've likely heard of the "relay attack," in which a device is used to capture the signal of a car key fob that is inside a house and then amplified to open car doors. But experts say there's a cheaper — and easier — solution thieves are turning to: lock picks. These tools are available for under $60 on online marketplaces.
Once inside the car, thieves typically plug a key programmer — available for under $1,000 online — into the car's On-Board Diagnostics (OBD) port, usually located under the steering wheel where mechanics can plug in a diagnostic tool to the car's computer. Using this port, thieves can program a blank key fob to match the vehicle. It can be done on nearly any vehicle with a push-to-start ignition. Vehicles with physical keys require a separate tool to clone the key.
WATCH | Locksmith shows how thieves steal vehicles:
It's an issue locksmith and founder of Hamilton's Auto Key Pro Yaser Jafar says needs more regulation.
"Anyone can buy these tools and do whatever they want," he told Marketplace. "When it's in the wrong hands, and if they have a little experience, or if they learn it, very quickly they can easily steal any car that they want."
More safeguards, such as a regulating body for locksmiths or a registration process to purchase tools, can prevent locksmith tools from getting into the wrong hands and would help curb theft, Jafar said.
Once the vehicle is stolen and left in a "cool down" spot to ensure it isn't being tracked, cars are typically driven to Montreal or Halifax, placed in shipping containers and shipped overseas. This can happen in as little as 24 hours, say police.
Honda's CR-V, Toyota's Highlander, Lexus's RX and Ford's F-150 are among some of the most popular models of cars stolen in Canada. O'Connor says it can take as little as two to 13 minutes to steal these vehicles.
The Insurance Bureau of Canada's list of top stolen cars includes the CR-V and F-150, but Marketplace was able to look at car theft data in Ontario and adjust theft rates for number of cars insured. Vehicles on this list include mostly luxury vehicles, including Lexus and Range Rover models.
Surprisingly, data obtained by Marketplace shows that electric vehicles are rarely stolen, and only one Tesla has ever been reported stolen in Ontario. Experts chalk this up to minimal infrastructure — and demand — for electric vehicles overseas, and enhanced security features like pass codes and 360 cameras.
In January, Peel police announced a multi-jurisdictional investigation — Project High Five — that resulted in 321 criminal charges and recovered more than 200 stolen vehicles. Some cars even had takeout containers and masks still in them when they were seized.
But Project High Five wasn't the solution to car theft. Just days after the arrests were made, Bart Evans had his 2018 Ford F-150 stolen from Sherway Gardens, a shopping mall in suburban Toronto, in the middle of the afternoon. It hasn't been recovered.
Now Evans is shopping for a replacement F-150. "My wife asked me, 'Do they still make The Club?' I said, 'Yes they do!' I'll be sticking that on (my new truck)."
'Manufacturers could certainly step up'
Marketplace heard from many victims of car theft who appeared to be doing everything right — storing keys in signal-blocking pouches or containers to prevent relay attacks, having security cameras on their driveways, even using a security club to lock their steering wheel and prevent the car from being able to turn. But police warn that thieves are quick to catch up to these methods and work around them.
"It shouldn't be this easy," said O'Connor. "The manufacturers could certainly step up, but with these vehicles being stolen they also sell more vehicles, and when vehicles need to be repaired they're selling more parts."
Marketplace asked manufacturers of some of the most stolen cars what was being done to prevent theft. All declined on-camera interviews, but in written statements all agreed that car theft is an issue that affects all brands.
-
Toyota, which owns Lexus, wrote that its vehicles comply with all Canadian regulations and that it is continually "developing and deploying new or improved technical features into new models to further strengthen their security."
-
Honda wrote that its newer vehicles include keys with an electronic code that makes it "extremely difficult to duplicate," and owners can connect with some vehicles through their smartphones.
-
Land Rover said it was the first manufacturer to introduce "UItra Wide Band technology" to thwart relay attacks, and said U.K. industry security experts gave Land Rover vehicles a "superior" security rating.
-
Ford said there is "no unique risk" identified for its F-150 vehicles, and suggested parking in secure, lit areas, and making sure vehicles are locked when unattended.
Meanwhile, some manufacturers are looking to implement stronger security measures such as biometrics or two-factor authentication to help curb car theft. Vehicle security companies already have tools that can be added aftermarket at the expense of the consumer, such as a lock for a car's OBD port, extra immobilizers or a personalized code drivers have to enter before the engine will start.
Experts such as Jafar and O'Connor suggest layering security measures is the best way to protect vehicles from being stolen. They say parking vehicles in garages, blocking in vehicles with less desirable cars and looking into aftermarket solutions are all ways that thieves can be thwarted until manufacturers strengthen the security in their vehicles.
"We can't keep up with the way it's going," said O'Connor. "Resources are all over the place. This comes [down] to layers of protection for the vehicle to ensure your vehicle doesn't become targeted."
With files from Patrick Cain
