Why your car's security may not be enough to prevent theft

My client Danie. I will not use his real name as he will recognise himself immediately. Anyway, Danie spent R14 000 on vehicle security last year. He has a Ghost immobiliser, a RF tracker, a Faraday pouch, smash and grab film on every window and a steering lock he purchased with great conviction and has used twice. What these things are and what they do is seldom explained, which is part of the problem. More on this later.

Danie is not careless. Danie is a careful, intelligent man who has spent a fair amount on security gadgetry and stopped thinking about it. He also leaves his key fob on the kitchen counter every night, eleven centimetres from an exterior wall. It broadcasts its signal cheerfully while he sleeps in his hollow.

The key fob, since we are here, is that small plastic remote clipped to your car key. The word fob, it turns out, is not a swear word and has nothing to do with cars or remotes or the modern habit of losing them between the couch cushions. A fob was originally a tiny hidden pocket sewn into the waistband of a gentleman’s trousers in the 1600s, specifically designed to hold a pocket watch. Close to the body. Out of sight. And difficult to pick. The Victorians, whatever else one might say about them, understood that if something was valuable, you kept it on your person and you did not leave it on a surface broadcasting into the street. Four hundred years later, we have taken this little word, attached it to one of the most important keys in our lives, and placed it on the kitchen counter, eleven centimetres from an exterior wall. Progress.

This, as we shall see, is as sensible as leaving your front door open with a note saying “Help yourself, I’m taking a kip”.

But first, a number. Six thousand. That is approximately how many vehicle hijackings were recorded in South Africa in the last three months of 2025. Which works out, for those who prefer their horror in bite-sized units, to more than fifty incidents every single day. Before lunch. Staggering.

And hold your horses. Before you begin researching property prices in Greenland, let us talk about what is really happening to your vehicle and, more importantly, what is not happening to protect it.

The factory alarm

Your car almost certainly came with an alarm. Reassuring? Possibly not.

A standard factory alarm is, in the grand tradition of South African customer service, largely decorative. It makes a noise. South Africans have learned, through years of patient conditioning, to completely ignore it. You have too, somewhere between the third and fourth false trigger in the Woolies parking lot. Thieves know this. They have, one suspects, conducted elaborate market research. Underestimate them at your peril.

There is also a YouTube channel dedicated entirely to bypassing the factory immobilisers, the electronic gizmo that is supposed to prevent your car from starting without the correct key. The presenter is calm, professional, and clearly enjoys his work. A single video on the subject, just one of hundreds, has around 847 000 views. Your factory alarm, to be blunt, addresses approximately the time of birth of our rainbow nation, circa 1995. The threats have definitely moved on.

The relay attack

Modern vehicle theft has gone rather upmarket. The scary gentleman in the balaclava with the brick is largely yesterday’s problem. Today’s automotive criminal is closer to a middling IT professional. Calm. Methodical. Carrying equipment that looks like it belongs in a Takealot order, not a police docket.

This is what a relay attack is. Your key fob, that plastic remote thingy-ma-jiggy, constantly emits a low-level radio signal. Your car is programmed to recognise that specific signal and only unlock when the signal is close enough. The manufacturer imagined close enough to mean you are standing next to the car. Two criminals with a pair of signal amplifiers, which you can find online for roughly the price of a decent braai pack, can intercept that signal from your key inside your house and extend it to your car parked outside. Your car, faithful and dim, assumes you are standing right there. It unlocks. They drive away. You discover this at six the following morning. Boof. All you have left of your precious SUV are the keys. And a spare set of keys.

Code grabbing follows a similar logic. The thief stands near you in a parking lot with a small device in their pocket, intercepts the signal you send when you press lock on your key fob, and replays it later. Your high-tech vehicle, affectionately called “Stallion”, the one with the touchscreen, the seat massage, the ability to parallel park itself, dutifully opens for a stranger. Talk about two-timing. Stallion cannot tell the difference. It just listens to a signal it recognises. Very nice. Not.

Danie’s fob, eleven centimetres from an exterior wall, is broadcasting like all night radio stations. They do not even need to be outside his gate. Just close enough. Surprise, surprise. This story has an unhappy ending. 

Put a pouch in it

A solution to the relay attack is a Faraday pouch. Named after Michael Faraday, a nineteenth century English scientist who discovered that a metal-lined enclosure blocks electromagnetic signals. Had Faraday known that his life’s work would one day be used to protect a Pretoria accountant’s BMW key from a man with a signal amplifier and bad intentions, he might have chosen a different career. But here we are.

A Faraday pouch is a small sleeve, usually leather on the outside and metallic mesh on the inside. You put your key fob in it when you get home. That is the complete protocol. The fob cannot broadcast inside the pouch. The relay attack cannot work on a signal that does not exist. The whole thing costs less than a tank of diesel and takes one second to work.

Danie has one. He just chooses not to use it. 

Your dealership’s advice. Well-intentioned and mostly wrong

You may be one of those risk-conscious individuals insurers adore, who visited your dealership and asked about additional security. Good for you. The dealership manager, a pleasant gentleman under considerable sales pressure, may have suggested a GPS tracker. May have reassured you that your factory security is “State of the art, quite good. Really”. May have also mentioned, with the gravity of someone delivering a terminal diagnosis, that installing third-party systems could void your warranty.

Two of those three things are either incomplete or untrue.

A GPS tracker, Global Positioning System, the same technology your Google Maps runs on, talks to satellites, and tells you where something is. A recovery tool. It does not prevent theft. It helps locate the vehicle afterwards, assuming the thieves have not stripped it of its tracker within the first forty minutes, which they routinely do. Recovery rates for the most targeted vehicles in South Africa sit below 30%. Your GPS tracker is not a guardian angel. It is an expensive booby prize.

The warranty myth is precisely that. Third-party security systems installed at authorised fitment centres do not void your vehicle warranty. This misconception persists because it is commercially expedient for it to persist. File it next to “This quote is a guideline only” and “We’ll be there now-now with a packet of Grabouw boerewors”.

The OBD back door nobody locks

Under your dashboard, usually somewhere near the steering column, is a small socket called the OBD port. OBD stands for “Ons Braai Dalk”. No, seriously, it means On Board Diagnostics.

Manufacturers installed it so that mechanics could plug in a laptop and read what is happening inside your car’s brain, warning lights, fault codes, and engine data. Very smart.

Criminals discovered that you can also plug a device into this port and reprogramme the car’s brain to accept a new key. The whole process takes under a minute. No breaking of glass. No dramas. Just a small device, a quiet moment, and your car now thinks it belongs to someone else. And there are, as duly noted, some 847 000 people on YouTube who know exactly how this works.

Enter the OBD port lock. A physical cover that prevents access to the socket, costs almost nothing and removes this option entirely. Most people do not have one. Most people do not know the port exists. I didn’t until I researched this article. How bizarre.

The engine bay problem 

Your bonnet is held closed by a release lever inside your cabin. If someone can access that lever, which I understand takes a bit of know-how and approximately four seconds of calm determination, they can open your engine bay. Once inside, they can disconnect the battery, disable the alarm siren, or, in the more ambitious cases, swap out the ECU.

The ECU, meaning the Engine Control Unit, also fondly known as “Eish, Car Useless,” is essentially the brain of your vehicle. It controls everything. Fuel, ignition. The works. A replacement ECU, programmed to accept a different key, turns your security system into a polite suggestion. The process of swapping one takes less time than SAPS takes to answer the phone. We tested both. We do not have the car anymore.

An under-the-bonnet locking module, an additional physical lock fitted inside the engine bay itself, prevents access to the battery, the ECU, and the components that bypass everything else. It is not glamorous. It is not something anyone will admire like a well-matured glass of “Cab Sav”. It is, however, the thing that stops the bad man with the replacement ECU from doing the mischievous thing he came to do. 

The “Ag, I’m Insured” Constituency

Are we all sitting down? I have no doubt the “Ag, I’m insured” constituency will want to protest at this point, and they deserve the floor. The argument is not without merit.

You pay your premiums. Every month. Without joy, but without fail. Comprehensive motor cover is an excellent product that exists precisely for this situation. The insurer will assess, process, and pay. The car will be replaced. Life resumes. This is the deal you signed, and the deal more or less works. Insurance policies are wonderful instruments of peace.

What they are not is miracle workers. The Uber bills. The borrowed bakkie from your brother-in-law smells like Austin (the dog) and optimism, if optimism smelled like a wet Boerboel marinating in a lunchbox that has not been opened since the 1995 Rugby World Cup. The strange seat settings, the stuck, arbitrary radio station, and the fuel economy warning you do not understand. The SAPS queue has its own ecosystem. People at the front have forgotten what they came for. People at the back have stopped caring. Somewhere in the middle, an old man is 100% focused on devouring a monster chiproll before having a futile negotiation with the ensuing heartburn. Then, the final coup de grâce is the discovery that “retail value” and “what it actually costs to replace what you had” are two numbers that are seldom the same.

Let's talk numbers and do some quick and mildly depressing arithmetic on a R2 million vehicle. For Danie, the basic and theft excess (yes, sorry to add injury to insult, you usually pay two excesses for vehicle theft) would probably sit at around R10 000 to R200 000. Why the large variance, you might say?  Some insurers’ motor excesses are a percentage of the vehicle’s sum insured. The solution. Negotiate a percentage-free vehicle excess or choose an insurer with percentage-free motor excesses. In Danie’s case, 10% of his loss is R200 000. Lucky for him, his risk advisor gave him the percentage-free option, which he took.

That is the first blow, before anyone has offered you so much as a condolence biscuit. Then, the premium increases, since predictive analytics says you are now a demonstrated risk, which is an actuarial way of saying you are no longer a good risk bet. So, at renewal, there is a 20% premium increase on a R60 000 annual premium, which is another R12 000 to R20 000 a year. Every year. So, before Danie has filled in a single form, he is already around R150 000 to R225 000 out of pocket. Not mildly depressing. Very depressing.

Then there is your time. The only thing in this entire episode that nobody can give back to you. Uninsurable. Non-refundable. Days of your life, lost forever.

And for business owners, your vehicles carry roughly double the hijacking risk of private ones. Not because criminals dislike the puffer jackets you manufacture. But because your bakkie is full of tools is a better return on investment. They are excellent mathematicians.

Talking prevention 

A Ghost immobiliser, the brand is Ghost, the product is a CAN-bus immobiliser, and, before you roll your eyes, CAN-bus simply means it connects directly to your vehicle’s internal communication network, the nervous system the various components use to talk to each other. It works using buttons already on your steering wheel or centre console. No extra key. No fob to carry. Nothing visible to anyone outside the vehicle. You programme a personal button sequence. Volume Up, Volume Up, Cruise Control, for example. Your car will not start without it. The man from YouTube, you know, the one with 847 000 subscribers, gets in with your key and then goes nowhere. Game, set, and match. It takes about three days to become muscle memory. Like your gate code. Like your seatbelt. Unlike the question. Did you put petrol in instead of diesel…? Except this one stops your magnificent Stallion from being stolen. Marvellous.

An RF tracker uses Radio Frequency, as opposed to GPS, which talks to satellites. RF communicates with local ground-based receivers and is considerably harder to jam, and the upgrade of your standard GPS tracker is not. When criminals use a signal jammer, a device that broadcasts radio noise to drown out your tracker’s communication, a GPS tracker goes silent, and you know nothing. An RF tracker on a system with a GSM alert, GSM being the mobile network, the same thing your phone calls run on, will notice the moment communication is disrupted and trigger an immediate alarm to your phone. The jammer, in other words, becomes the evidence.

A visible steering lock or gearlock tells a thief, at a glance from across a parking bay, that this car needs tools and time he may not have. He pauses. He recalculates. He says, under his breath, “Wag ’n bietjie, nee man. This is a flipping big job”. He moves to the next car. It is a probability shift. In risk management, probability shifts are gold dust.

These days, insurers want minimum vehicle security compliance. Fair enough, in the main. A tracker. Often two trackers. An approved immobiliser. You will see this on your policy schedule. And if you have not got one or read it lately, you are playing with insurance fire. You will also need the instruction manual (the policy), and if you are like most people who find reading manuals less appealing than watching paint dry, then you need a decoder. No, not DSTV, a professional risk advisor to help you make sense of it all.

What no policy schedule has ever stated is the risk approach mindset. That is yours. And it will show in your premiums sooner or later. 

Two-factor & the nowhere man

Which brings us, rather neatly, to the Ghost immobiliser’s secret weapon. Two-factor authentication. You know how this works already. Your bank trained you, or your IT guy interrogated you. Two steps. Two separate proofs that you are who you claim to be. The logic being that even if a criminal gets hold of your password, he still cannot get in without your phone. It is the reason your savings account has not been emptied by the usual suspect in Bucharest, despite his obvious charm.

Your Ghost immobiliser applies exactly this principle to your vehicle. The thief gets your key. Maybe he grabbed it from your house, maybe he cloned it with a relay attack, maybe the YouTube man lent him a hand. Whatever. He gets in. He inserts or signals the key. The car recognises it. And then. Niks. The engine will not start. Sorry Mr Crook, you need step two. The button sequence is only known to you. Without it, he is sitting in your expensive Stallion’s high-end leather chair, with 3 levels of massage, going nowhere. Poetic justice.

So, how is it that for a vehicle worth close to 2 million Randelas, this is still considered excessive? If considered at all. This is an interesting prioritisation. Your Gmail account and Stallion are not, one suspects, equally replaceable.

Danie, Revisited

One final thought, aimed directly at the insurers, who may read this with a mixture of agreement and mild intrigue. Possibly mild amusement.

You already reward clients for not claiming. Thank you. Some do it in very odd, counterintuitive ways, in my view, like cash back bonuses, but that is a story for another day. Let’s just say the principle is established. So, here is a question worthy of making a boring meeting, a board meeting. Why not reward clients who proactively mitigate vehicle theft risk? Verified Ghost immobiliser fitted? Two-Way Vehicle Authentication, check. Reduced or no vehicle theft excess, maybe? Faraday pouch protocol, confirmed? Premium discount, pretty please? Under the bonnet locking module installed? A free doughnut? Just kidding. Maybe we call it the “Danie Clause”. Handmade for the client with “I pretend like I’m not insured " mindset, you know the one who costs you less. The industry that invented usage-based insurance and so many other innovations, no doubt has the imagination and, hopefully, the inclination. It usually just takes one forward thinker, as they say.

Danie has since moved his fob. We had a frank conversation. He was vaguely annoyed with me, which is fine. Respect is better than popularity. We are still good friends. The steering lock is now in use. The gearlock in the boot remains in the boot, but we are making progress.

He also told me, as he was leaving, that the whole thing felt like a bit much. Over the top, verging on paranoia. Surely it would never happen to him. I thought to myself, optimism bias is alive and well in South Africa. And then, after a measured pause, I told him that the man with 847 000 views probably has a client who said exactly that.

The chop shops are not closing. The syndicates are not losing interest in your suburb. And the gap between what the policy pays and what the whole experience costs, in time, in uninsured financial loss, in disruption. That gap is real, and it is yours alone. No premium covers it.

The best outcome in vehicle security is a theft that never happens. Prevention is always better than premium.

Put the fob in the pouch. Or do not. You are insured. What could go wrong?

 * Chadwick is the CEO of Chadwicks. He advises businesses and individuals on risk and insurance. He also writes on the psychology of risk. 

** This is a work of fiction for educational purposes only. No permission is granted for AI training, scraping, or use in model development. The characters, events, and conclusions described are hypothetical and illustrative. This content is not professional insurance, financial, or legal advice and should not be relied upon as such.

***The views expressed herein are not necessarily those of Personal Finance or Independent Newspapers.

PERSONAL FINANCE