Electronic car theft: how thieves get in without breaking anything (and what is left damaged afterwards)

Every summer the same scene repeats itself in insurers' claim reports: cars that vanish from a garage, from outside a hotel or from a beach car park without a broken window, without a forced lock and without stripped wires under the steering wheel. The owner has the key in their pocket. And yet the car was opened and started.

It is not magic, it is electronics. The car cybersecurity reports published throughout 2026 agree on the same diagnosis: theft has stopped being a problem of force and has become a problem of signals. INCIBE has been warning for some time that the CAN bus and the diagnostic connector can become an entry point, and Europol has dismantled networks that worked in exactly this way. With more than fifteen million connected cars on the road in Spain, the issue is no longer anecdotal.

What almost nobody talks about is the second part of the story: what is left damaged inside the car after a theft attempt, whether or not they take it. That is the part we see every day in the workshop.

The four ways in without breaking anything

1. Relay attack (signal repeater attack)

This is the best known, and it affects keyless entry and start systems. The key constantly emits a low-power signal; with two amplifying devices, that signal can be captured near the house and relayed to the vehicle, which believes the key fob is right next to it. The car opens and starts. Not a scratch.

2. Jamming (blocking the lock signal)

Nothing is opened here: the car is prevented from receiving the lock command when the driver presses the fob and walks away. The vehicle stays unlocked without the owner knowing. It is a classic at motorway service areas and shopping centre car parks.

3. Replay and rolling codes

Modern key fobs use a rolling code so that a captured signal cannot be used twice. On paper it is a good defence, but variants capable of reusing recorded signals have been documented, and the technical barrier has been falling in recent years.

4. CAN injection

This is the technique that has grown the most and the one that creates the most work for us afterwards. Instead of struggling with the key, the vehicle's wiring is accessed through an accessible external point, usually the headlight area or some part of the bumper, and messages are injected into the car's internal network, posing as a legitimate module. The result is that the vehicle receives a "valid key present" command that never existed, disables the immobiliser and allows the engine to start.

The part you cannot see: what is left affected afterwards

This is the key point, and it is the reason why many cars recovered by the police or by the owner themselves keep giving problems weeks later. An attack of this kind leaves a trace inside the electronics:

• Tampered wiring and connectors. To reach the bus, a connector is tapped, cut or forced. Even if it is put back together, bad contacts remain that cause intermittent faults months later.
• BSI, BCM or UCH with altered memory. The body control unit records everything that has gone through the bus. After a message injection it is common to find impossible fault codes, changed configurations and phantom drains that flatten the battery.
• Desynchronised immobiliser. The car can be left in an intermediate state in which the original key no longer communicates properly with the start module: EZS/EIS on Mercedes, CAS on BMW, UCH on Renault and Dacia.
• Keys added to the system. This is the most serious point and the one most often overlooked. If a new key was registered during the attack, that key still opens and starts the car even after the vehicle has gone back to its owner. Getting the car back does not mean getting control back: all keys must be erased from the system and only the legitimate ones registered again.
• ECU with tampered programming. In some cases the engine unit is manipulated directly to bypass the immobiliser check.

Signs that someone has tried (even if they did not take it)

• Headlight screws or trim with recent marks, or a headlight that moves when pushed.
• The battery is flat in the morning for no apparent reason.
• Warning lights that come on at the same time, an instrument cluster that restarts, or central locking that behaves erratically.
• The car is slow to recognise the key, or you have to hold it up to the emergency reader.
• A "key not detected" message appears intermittently.

If any of these symptoms sound familiar, it is also worth reading our guide on why the immobiliser fails and the article on immobiliser and CAS module problems.

How to reduce the risk without going mad

• Keep the key in a shielded pouch and away from the front door. It is the cheapest and most effective measure against the relay attack. Check it yourself: with the key inside the pouch, the car should not react when you bring your hand close to the door handle.
• Activate the start code if your vehicle allows it. Many models come with it deactivated from the factory.
• Switch off the key's passive emission at night, if your brand offers that option.
• Always check the lock by pulling the handle before you leave. It is the direct defence against jamming.
• An immobiliser independent of the original system adds a layer that message injection through the bus cannot bypass.
• If the car is second-hand, make sure you know how many keys are registered in the system. Not how many you were handed: how many the car recognises.

What we do when a car like this arrives

At ECUmotorstock we work precisely with the electronics that are left affected in these cases. We read the module on the test bench, check which keys the vehicle really has registered, erase the ones that should not be there and return the unit to a clean state, synchronised with the rest of the car.

If your vehicle has suffered a theft attempt or you notice any of the symptoms above, these are the pages where you can see the service you need and send us your case:

• Car key repair and lost keys, to regain control of the key system.
• BSI unit repair and BCM modules, for the body control unit.
• CAS module, EZS/EIS and Renault and Dacia UCH, depending on the make.

We work with shipping from all over Spain and home collection, with a test bench to verify each unit before returning it. And we keep our usual rule: if we do not repair it, you do not pay.

A recovered car is not a safe car until the electronics are clean again. That is the part of the job that almost nobody does, and it is exactly ours.