The State of Keyless Car Theft in Australia 2026: Stats, Methods & What Actually Works to Stop It

Last updated: June 2026

Direct answer. Keyless car theft in Australia is no longer niche - it is the dominant method. Three attack vectors now account for most stolen vehicles: OBD reprogramming (30-40% of Victorian thefts), CAN bus injection (organised crime), and persistent relay attacks. Victoria is the epicentre, with 33,212 vehicles stolen in the year to September 2025 and 30 cars per day via electronics. This article breaks down each method, the data, and what actually works.

Table of contents

1. How Many Cars Are Being Stolen in Australia Right Now?
2. Why Is Victoria the Worst State for Car Theft?
3. How Do Thieves Steal Keyless Cars in 2026?
4. What Is CAN Bus Injection - and Why Is It Different?
5. What Are Car Manufacturers Doing About It?
6. What Actually Works to Stop Keyless Car Theft?
7. What About the Rest of the World?
8. Frequently Asked Questions
9. Sources

How Many Cars Are Being Stolen in Australia Right Now?

The Australian Bureau of Statistics recorded 65,603 victims of motor vehicle theft in 2024 - an 8% increase year-on-year (ABS, 2024). That works out to roughly one car stolen every eight minutes, nationally.

The national figure masks a deeply uneven story. Victoria drove almost the entire increase, posting 22,504 victims in 2024 - up 41% from 2023 and the state's highest total since 2003 (ABS, 2024). Meanwhile, New South Wales saw a modest 6% increase, and every other state and territory recorded flat or declining numbers.

The Insurance Council of Australia reports that Victoria's motor vehicle theft claims rose 25% year-on-year in 2025, with costs up 37% - more than all other states and territories combined (ICA, June 2026). Victorian claim frequency leapt from 0.26% to 0.45% - a 73% increase.

Queensland is the notable counter-example: motor theft claims fell 12% (from 6,900 to 6,100) between 2024 and 2025, the largest single drop on record (ICA / QLD Government, June 2026). The national picture is not a uniform crisis - it is a Victorian crisis amplified by specific electronic attack methods.

Why Is Victoria the Worst State for Car Theft?

Victoria's car theft problem is not new, but the scale is. In the 12 months to September 2025, 33,212 vehicles were stolen across the state (ABC, March 2026). Victoria Police attribute 30-40% of all thefts to key cloning and OBD reprogramming devices, with electronic methods accounting for roughly 30 stolen cars per day (Victoria Police, May 2026).

By 2025, Victoria's car theft rate was 123% higher than NSW - a gap that had historically averaged just 42% between 2018 and 2023 (Crime Statistics Agency / BOCSAR).

The tools are not hard to come by - more than 1,100 key reprogramming devices were seized by Victoria Police in 2025-2026 (Daily Telegraph, 2026). Deputy Commissioner Bob Hill described the speed of these thefts: "It would be a matter of 10, 15 seconds" (ABC, March 2026).

The financial toll is severe: the ICA recorded $243 million in insurance claims across 12,500+ theft claims in Victoria alone for 2025 (ICA, June 2026).

The most stolen vehicles (tech-assisted theft, Victoria)

Victoria Police data, reported by CarExpert in March 2026, shows the biggest surges in tech-assisted theft:

Toyota models dominate the list, which explains why the manufacturer has been the most vocal about countermeasures (more on that below).

Where thefts are happening

The traditional hotspots - Melbourne CBD, Dandenong, Tarneit, Narre Warren, St Albans, Craigieburn, Southbank, Reservoir, Truganina, and Epping - have been joined by new suburbs in 2026: Berwick, Malvern East, Clayton, and Glen Waverley (Crime Statistics Agency, 2026). The shift from inner-north and western suburbs into the eastern suburbs suggests organised crime networks are expanding their operational footprint.

Operation Nighthawk

Victoria Police launched Operation Nighthawk in September 2025, targeting the Hume region (Broadmeadows, Craigieburn) with uniform police, detectives, Highway Patrol, Dog Squad, and Air Wing. As of mid-2026, multiple iterations of the operation have resulted in 180+ arrests and 527 charges, along with seizures of stolen cars, key reprogramming devices, firearms, and drugs (Victoria Police).

How Do Thieves Steal Keyless Cars in 2026?

Modern keyless-entry vehicles - which includes almost every car sold in Australia today - are stolen through three primary electronic attack vectors, not the screwdriver-and-jump-wire methods of the past.

1. OBD Port Reprogramming (Mass Market)

How it works: Every modern car has an OBD-II diagnostic port under the dashboard. Thieves gain cabin access (via relay, a smashed window, or an unlocked door), plug in a handheld key programmer, and within 60-90 seconds override the immobiliser and program a blank key fob. The car starts and drives away as if the thief owns it.

Why it dominates: The devices cost under $100 and are legally sold online for legitimate locksmith work. No specialised training is required. Victoria Police notes that OBD reprogramming accounts for 30-40% of all Victorian thefts (Victoria Police, May 2026).

Vulnerable vehicles: Any push-to-start vehicle with an accessible OBD port - which is effectively everything sold since roughly 2001.

Countermeasure: OBD port locks (physical blockers that cover the port, available from auto parts stores for $30-80).

2. CAN Bus Injection (Premium Organised Crime)

How it works: Instead of plugging into the OBD port, thieves drill into the vehicle's bodywork - typically through a door panel, headlight housing, or wheel arch - to access the CAN (Controller Area Network) wiring directly. They inject counterfeit CAN messages that command the vehicle to: unlock all doors, disarm the immobiliser, disable GPS tracking, and start the engine.

Why it matters: This is the newest and most sophisticated vector, used by organised international crime rings. Devices cost $5,000-$10,000 on the black market. It was publicly documented as far back as 2022 (CVE-2023-29389) but has become a mainstream threat only in the past 18 months.

The Queensland bust: Between 20 October and 1 December 2025, 60 Toyota vehicles were stolen in Brisbane using CAN injection - valued at $8-9 million. Seven foreign nationals were charged with 380+ offences; they had flown to Australia specifically to steal cars. Only 15 of the 60 vehicles were recovered; the rest were shipped to the United Arab Emirates in shipping containers (News.com.au, January 2026; Queensland Police Service, January 2026).

Earlier in 2025, more than 150 Toyotas were stolen in Victoria using the same method (CarExpert, January 2026).

Primary targets: Toyota LandCruiser 300 Series, Prado, and HiLux.

Countermeasure: Aftermarket immobilisers (Ghost-style PIN-code devices) and physical security (steering wheel locks).

3. Relay Attacks (Persistent)

How it works: Two thieves work together. One stands near your front door with a radio amplifier, capturing your key fob's faint signal from inside the house. The signal is relayed to a second device near the car, which re-broadcasts it. The car unlocks and starts, never knowing the key fob is actually in your hallway.

Range: Amplification can work from 30-100 metres between the two devices.

Cost of equipment: Under $100 for basic relay hardware.

Why it persists: Even the latest Tesla Model 3 remains vulnerable despite its UWB (ultra-wideband) upgrade - researchers at GoGoByte demonstrated the vulnerability in 2026. Tesla's position: "UWB was not intended to stop relay attacks" and recommends PIN-to-drive as a mitigant.

What Is CAN Bus Injection - and Why Is It Different?

CAN bus injection represents a fundamental shift in how organised crime steals cars.

The CAN bus is the vehicle's internal communication network - the wiring harness that lets the engine control unit, body control module, infotainment system, and dozens of other electronic control units talk to each other. It was designed for reliability, not security. There is no authentication: any device connected to the CAN bus can send messages that every other module will trust and act on.

CAN injection attacks exploit this architectural weakness. Instead of using a locksmith tool at the OBD port (which is at least a consumer-grade device), thieves use specialised black-market hardware that breaks into the CAN wiring directly - often by drilling through body panels to reach the harness behind the headlight or inside the door.

The technical origin: The attack was detailed in a 2023 technical paper by CAN-CIA (CAN in Automation) and assigned CVE-2023-29389. It took about two years for the technique to move from academic research to operational criminal use at scale (ACS Information Age, January 2026).

Why Toyota is the primary target: Toyota's CAN architecture has been reverse-engineered by criminal networks. The LandCruiser 300 Series, Prado, and HiLux share similar CAN bus layouts, making a single injection device compatible across multiple high-value models. These vehicles are also in high demand on international black markets - particularly in Africa and the Middle East.

What makes it hard to defend against: CAN injection does not require a key, does not use the OBD port, and can disable GPS tracking before the vehicle leaves the street. Factory CAN bus monitoring is still rare in production vehicles, though Toyota has begun implementing hardware-level countermeasures.

What Are Car Manufacturers Doing About It?

Toyota

Toyota has been the most affected manufacturer and the most proactive. Key actions as of mid-2026:

• Hardware-level security upgrades to 2025/2026 HiLux, LandCruiser 300, and Prado models. Specific details are confidential (Toyota Press Room, January 2026).
• A factory-approved aftermarket immobiliser coming mid-2026, announced by John Pappas, VP Sales and Marketing, to CarExpert.
• Genuine Toyota steering wheel lock ($200 dealer accessory) - a visible mechanical deterrent.
• Calling for a federal ban on CAN injection devices and regulation of locksmith tools (Drive, 2026).
• Prioritisation system for theft victims to receive replacement vehicles faster.
• Collaboration with the Victoria Police / Queensland Police task force.

Ultra-Wideband (UWB)

UWB is the automotive industry's planned technical solution to relay attacks. Unlike traditional radio signals, UWB measures the precise time-of-flight of a signal, allowing the car to determine whether the key fob is physically inside the vehicle or being relayed from a distance.

• UWB adoption is growing: the CCC Digital Key Release 3 specification includes UWB, and chipsets like the STMicro ST64UWB are entering production.
• The UWB market is projected to grow at 11.7% CAGR between 2025 and 2030 (FiRa Consortium).
• However, UWB is not a silver bullet. The 2026 GoGoByte research demonstrated that the latest Tesla Model 3 - which has UWB - remains vulnerable to relay attacks.

Tesla

Tesla addressed a significant vulnerability in early 2026: CVE-2025-6785, a CAN injection vulnerability in the Model 3 and Model Y discovered by security researchers at PlaxidityX. The vulnerability allowed an attacker to inject malicious CAN messages without key authorisation. Tesla patched it via over-the-air firmware update 2023.44.

A PlaxidityX researcher noted: "If it was possible to steal a Tesla... imagine how vulnerable the average car is" (PlaxidityX, 2026).

Tesla continues to recommend PIN-to-drive as the primary defence - a PIN code that must be entered on the touchscreen before the car can be driven.

Regulatory landscape

Internationally, the UK passed the Crime and Policing Act 2026 (Royal Assent April 2026), which creates a new criminal offence for possessing electronic vehicle theft devices - punishable by up to five years' imprisonment. No equivalent federal legislation exists in Australia, though manufacturers and state police forces are calling for it.

What Actually Works to Stop Keyless Car Theft?

No single measure guarantees your car won't be stolen, but a layered approach - combining physical, electronic, and behavioural defences - dramatically reduces the risk.

1. Use a Faraday Pouch or Box for Your Key Fobs

This is the cheapest and easiest defence against relay attacks. A Faraday pouch is a lined fabric sleeve that blocks radio signals. When your key fob is inside it, no relay device can capture or amplify its signal.

• Cost: $16-$45 depending on size and style.
• What to look for: A pouch or box that fully encloses the fob with no gaps - tested to MIL-STD-188-125-2 or equivalent. The Aus Security Water-Resistant RF-Blocking Key Fob Faraday Pouch ($15) is a well-tested option.
• Important: Test your pouch by placing the fob inside and trying to unlock your car.
• Home storage: For a family with multiple fobs, the Aus Security Signal-Blocking Faraday Box (Medium) ($44.95) holds 8-12 keys.

For more detail see: Faraday Bags Explained: How They Work and Why You Need One.

2. Enable PIN-to-Drive (Tesla) or Equivalent

If you drive a Tesla, enable PIN-to-drive in the vehicle settings. This requires a 4-digit PIN on the touchscreen before the car will move.

• Cost: Free.
• Applicable vehicles: Tesla models (all). Some other manufacturers offer similar features.

3. Install a Steering Wheel Lock

A visible mechanical lock is one of the simplest and most effective deterrents.

• Cost: $30-$200.
• What to look for: A lock that covers the entire steering wheel rim and is brightly coloured.
• Note: Toyota now sells a genuine steering wheel lock as a dealer accessory for $200.

4. Install an Aftermarket Immobiliser (Ghost-Style)

A Ghost immobiliser requires a unique PIN code before the engine will start. It connects directly to the CAN bus and cannot be bypassed via OBD reprogramming.

• Cost: ~$1,600 including professional installation.
• Advantage: Cannot be defeated by key reprogramming or CAN injection.
• Who should consider it: Owners of high-risk vehicles (LandCruiser, HiLux, Prado, RAV4).

5. Install an OBD Port Lock

An OBD port lock is a physical bracket that covers your car's diagnostic port.

• Cost: $30-$80.
• Where to buy: Available from auto parts stores. (Note: Aus Security Products does not stock OBD port locks.)

6. Use Aftermarket GPS Tracking

• Cost: $100-$300 for the device, plus a monthly subscription ($10-$30).
• Note: CAN injection attacks can disable factory GPS tracking. An aftermarket tracker hidden elsewhere may survive.

7. Park Smart

• Park in a garage or secure car park whenever possible.
• If parking on the street, choose well-lit, high-traffic areas.
• Avoid leaving your car in the same spot every night.
• Do not leave documents with your home address in the glovebox.

Prevention Summary Table

What About the Rest of the World?

United Kingdom

• 58% of all vehicle thefts in England and Wales now involve keyless methods (CSEW), up from just 14% in 2019.
• By Q2 2025, the ABI reported that 89% of stolen vehicles were taken via keyless attacks (ABI, 2025).
• Over 100,000 vehicles are stolen annually; only 40% are recovered.
• The annual cost is £714 million, with an average claim of £22,500.
• Thatcham Research found that 78% of drivers are worried about keyless car theft.
• International theft rings ship stolen SUVs to Congo, the UAE, Cyprus, and Jamaica (BBC, 2026).

The UK response: The Crime and Policing Act 2026 created a specific criminal offence for possession of electronic vehicle theft devices - carrying up to five years' imprisonment.

The Australian context is different, but the trajectory is similar. The UK saw its keyless share grow from 14% to 89% over six years. Australia is on a comparable curve.

Frequently Asked Questions

Can a keyless car be stolen without the key?
Yes - this is the central problem. OBD reprogramming and CAN bus injection both bypass the key entirely. Only relay attacks require proximity to your existing key fob.

Are new cars safer than older cars?
Not necessarily. Post-2001 vehicles with immobilisers are exactly what OBD reprogramming exploits. Newer luxury vehicles with CAN bus architectures can be more vulnerable. Manufacturers are improving security on 2025-2026 models, but the installed base will remain vulnerable for years.

Does putting my key fob in the microwave stop relay attacks?
Do not do this. A microwave's shielding is designed for 2.4 GHz, not the 315-868 MHz frequencies used by most key fobs. Use a proper Faraday pouch or box.

Does car insurance cover keyless car theft?
In most cases, yes - comprehensive insurance covers theft regardless of method. However, some insurers are asking about electronic security measures. Check your PDS. Premiums in high-theft postcodes are likely to reflect the risk (ICA, June 2026).

Is my Tesla vulnerable to keyless theft?
Yes, though the attack surface is different. Tesla patched CVE-2025-6785 (CAN injection) via OTA update in early 2026. However, GoGoByte research showed even the latest Model 3 with UWB remains vulnerable to relay attacks. Enable PIN-to-drive.

What should I do immediately if my car is stolen?
1. Contact police immediately. 2. Lodge a claim with your insurer. 3. Notify any tracking service. 4. If a relay attack was used, secure your remaining keys in a Faraday pouch. Recovery rate in Victoria is approximately 80% (ABC, March 2026).

Sources

• ABS (2024): Australian Bureau of Statistics, Recorded Crime - Victims, Australia, 2024.
• ABC (March 2026): Victoria's car theft crisis: 33,000 vehicles stolen in 12 months.
• Victoria Police (May 2026): Media briefing on OBD reprogramming thefts.
• Daily Telegraph (2026): Key reprogramming device seizures in Victoria.
• ICA (June 2026): Insurance Council of Australia, Motor Vehicle Theft Claims Data 2025.
• CarExpert (March 2026): Victoria Police theft data by vehicle model.
• Crime Statistics Agency (2026): Victoria Crime Statistics, quarterly data.
• News.com.au (January 2026): Queensland CAN injection theft ring report.
• Queensland Police Service (January 2026): Brisbane CAN injection media release.
• ACS Information Age (January 2026): CAN injection feature article.
• CAN-CIA (June 2023): CAN bus security paper, CVE-2023-29389.
• PlaxidityX (2026): CVE-2025-6785 Tesla CAN injection advisory.
• GoGoByte/Cybernoz (2026): Tesla Model 3 UWB relay attack demo.
• FiRa Consortium (2026): UWB market growth projections.
• Toyota Press Room (January 2026): Hardware security upgrade announcement.
• Drive (2026): Toyota federal device ban proposal.
• Thatcham Research (2025): UK keyless car theft research.
• ABI (2025): Association of British Insurers, UK claims data.
• BBC (2026): International vehicle theft rings.
• Crime and Policing Act 2026 (UK): Possession offence legislation.

Additional reading on Aus Security Products

• Faraday Bags Explained
• Ghost Tap: The NFC Scam
• Phone Pouches for Schools Guide
• Aus Security Water-Resistant RF-Blocking Key Fob Faraday Pouch
• Aus Security Signal-Blocking Faraday Box (Medium)