OBD key cloning: how thieves program a new key

Relay theft gets most of the attention, and it deserves it. But there is an older method that still works on a lot of cars, including plenty that do not have keyless entry at all. Thieves get inside the car, plug into the socket every garage uses for diagnostics, and give the car a new key of their own.

People usually call this key cloning. Strictly, it is more often key programming: rather than copying your key, the thief teaches the car to accept one they brought with them. The result is the same. They drive away on a key the car believes is genuine.

What the OBD port is

OBD stands for On-Board Diagnostics. It is a socket, usually low down near the driver’s footwell, that garages plug into to read fault codes, reset service lights and carry out other work on the car’s systems. One of the jobs it can do is add a replacement key when you lose one.

Every modern car has one, and that is deliberate. As Thatcham Research explains, fair-trading rules require the port to be easy to reach and uniform, so independent garages can work on cars as well as main dealers. That is good for you when you need a repair. It also means the same socket is sitting there for anybody who gets inside.

How the theft works, in outline

We are not going to describe this in any detail, for obvious reasons. The broad shape is well known and is published by the police-backed Secured by Design scheme.

They get into the car. This is the step people forget. Unlike relay theft, the thief has to be inside before anything else can happen, which usually means forcing a door or breaking a window.

They connect a device to the port. The equipment is built to talk to the car the way a garage’s diagnostic kit would.

They program a blank key. The car accepts the new key as one of its own, and it starts the car like any other key.

It is quick when it works, and it does not depend on your key being anywhere nearby. Your keys can be upstairs in a drawer or in a Faraday pouch and it makes no difference.

Thatcham’s consumer security ratings for new cars test for exactly this. Its technicians check whether the OBD port allows blank keys to be coded, and a car that fails is marked down a category (Thatcham Research, 2019). So manufacturers know about it, and many newer cars are harder to attack this way than older ones. Harder is not the same as immune, and there are a great many older cars on the road.

How it differs from relay theft and CAN injection

It helps to see the three methods side by side, because they defend differently.

Relay theft carries your keyless key’s signal from inside the house to the car. Nothing is broken and the factory alarm stays quiet. It only works on cars with keyless entry and start. We have explained how relay theft works in detail.

Key programming through the OBD port needs the thief inside the car first, but it does not need your key at all, and it works on many cars with a conventional key too.

CAN injection, sometimes called headlight theft, is newer. Thieves reach the car’s internal wiring from outside, often behind a headlight, and send messages that make the car think a valid key is present. As The Conversation reported, a Faraday pouch cannot stop it because the key is not involved at all.

What all three have in common is that they end with the car believing a legitimate key is present. That matters when you choose what to fit.

What genuinely helps

An immobiliser that ignores the key. This is the strongest answer, because it does not care how the thief got a working key. An Autowatch Ghost III is hidden in the car and will not let the engine run until a code is entered on the car’s own buttons, or it sees your authorised key-tag or phone. A freshly programmed key gets nowhere, because the Ghost was never asking about the key. The Pandora Microbot works on the same principle. It is authorised by a Bluetooth tag, a PIN on the steering wheel buttons or the app, and depending on the car it can block the engine, engine start, automatic gearbox and keyless system. It also holds Thatcham CAT 2e approval and has Anti-HiJack built in. We have compared the two if you are choosing between them.

An alarm that notices the break-in. Because this method starts with getting into the car, it gives an alarm something to detect, which relay theft does not. A Pandora alarm with its own sensors sends an alert to your phone, so you are not relying on a neighbour taking any notice of a siren.

An OBD lock or guard. Secured by Design suggests considering a professionally fitted OBD lock guard. It is a physical cover over the port, and it can slow somebody down or send them elsewhere. Be realistic about its limits, though. It is a mechanical barrier inside a car the thief is already sitting in, it does nothing about relay theft or CAN injection, and the garage will need it opened every time the car goes in for work. Secured by Design also notes that electronic OBD security is available from some manufacturers, so it is worth asking your dealer.

A tracker. None of the above recovers a car that has already gone. A Thatcham tracker is the layer that helps get it back, and some insurers ask for one on higher-risk cars.

Most people do not need all four. The immobiliser keeps the car on the drive, and the other layers are about knowing sooner or getting it back. Which mix makes sense depends on the car and on what your insurer has asked for.

Small things worth doing anyway

Lock it every time. It sounds too obvious to write down, but Secured by Design puts it first, and an unlocked car removes the one step that slows this method down.

Account for every key. If you bought a used car with only one key, Thatcham Research advises having the missing keys deleted from the car by an approved repair centre and a spare added.

Do not leave the car easy to work on. Parking where the car is overlooked, lit or off the road does not stop a determined thief, but this method needs a few undisturbed minutes inside the car, and anything that makes those minutes uncomfortable helps.

Is your car at risk?

Almost every car on the road has the port. Whether it can be abused this way depends on the make, model and age, and we are not going to publish lists of which ones.

What we can do is tell you straight about your own car. Tell us the make, model and year, and we will tell you what we would fit, or whether you need anything at all.