This is part two of a three-part investigative series by CTV W5 on how car thieves are able to make off with modern vehicles so easily. W5 correspondent Jon Woodward ordered a device that had been flagged by police and used it to clone a vehicle key.

A device that can be used to clone a car key and drive it away without the owner’s assistance can be ordered online, delivered within days and up and running in less than an hour, a W5 investigation has found.

How do we know? Because we did it.

And the demonstration illustrates what some say is a continuing security lapse, even as governments, law enforcement agencies and insurance companies scramble to stem a wave of thefts that totaled about $1.5 billion last year.

“I think we have a crisis on our hands in this country,” said Elliott Silverstein of the Canadian Automobile Association, pointing to figures showing more than 70,000 vehicles were stolen in Canada in 2023.

“You think of a natural disaster, like a flood, hurricane or fire, and you imagine it happening every day of the year with no end in sight. That’s the problem with car theft right now in Canada,” Silverstein said.

The federal government passed new regulations to restrict some radio devices that could be used to steal cars, following a national summit earlier this year. Figures from investigative group Equite Association show car theft has fallen by 17% this year.

But during a consultation on limiting the devices used by thieves, York Regional Police Service brought up brands of key reprogrammers which are also said to be used in car thefts.

A thief uses a tablet to access a vehicle in surveillance video obtained by W5

These are the devices that can be seen on some surveillance videos, with thieves huddled over tablet screens, usually with a cable connected to the car’s computer.

They can also be used legitimately by car owners who want to get new keys or find faults with their vehicles.

• Part One: How did thieves steal your car? Maybe with a device they ordered online

The federal government told us they had restricted some devices — but those key programming devices appeared to be widely available. So that decided to order the W5.

Our device cost about $835.07 through online retailer Amazon.ca and was sold by a Chinese company.

It arrived in a few days in a black plastic carrying case with an accessory that allowed it to connect to the car as well as two universal key fobs.

The W5-powered device guided its user through the steps to clone a key – even if the vehicle’s original key was nowhere to be found

Once loaded, it allowed us to download files corresponding to a variety of car models, including Ford and Chevrolet. His operating system provided instructions on next steps.

W5 won’t explain exactly how I used it. When I tried it on two vehicles in the CTV fleet, the keys were nowhere to be found.

The first attempt, on a Chevrolet SUV with push-button ignition, didn’t work. The device gave error messages saying it could not connect to the internet.

However, on another CTV vehicle, a Ford SUV with a push-button ignition, our device went through all the steps, and one of those universal fobs matched the car.

With that newly programmed key inside the Ford cabin, the car started and I was able to drive it away.

W5 reporter Jon Woodward used a tablet ordered online to investigate concerns police are expressing about certain devices that can clone car keys

“These devices are out there, and that’s a problem,” Silverstein said. “Is it like having lock picks for sale on the internet?”

I contacted Ford with the specific details of the demonstration. A company spokesperson, Matt Drennan-Scace, told us that our demo didn’t reflect real-world conditions because the car doors were initially unlocked and we didn’t set off an alarm in the car.

But locksmith and engineer Yaser Jafar, who uses the devices legally as part of his Hamilton-based company Auto Key Pro, said in his experience the devices can be used in those scenarios as well.

“Thieves, unfortunately, have the same exact tools, they take the same exact steps to be able to steal the cars there,” Jafar said.

Amazon has said that all devices for sale on its site are there legally, although even legal devices can be misused.

Manufacturer: Devices ‘not for illegal activities’

Device maker Autel, based in New York, said in a statement to W5 that it is aware that key reprogramming tools have been found in the possession of people involved in vehicle thefts and is cooperating with US authorities as they seek to inquire about its technology. .

“Our immobilizer and key programming tools are designed for professional locksmiths to expand their repair service capabilities, not for illegal activities,” said spokeswoman Allison Whitney.

“We have improved the technical capabilities of our products to prevent their misuse, including by integrating two-factor authentication. We are exploring other solutions, such as cooperation with third-party credentialing service providers,” said Whitney.

“The solution to reducing vehicle theft is a complex one. It will require the concerted efforts of all parties involved – automakers, professional tool developers, law enforcement, policy makers and the driving public – to achieve meaningful change. Autel is committed to being part of this solution,” she said.

Scace said Ford considers security a top priority and said it is releasing new devices to keep cars safe.

It launched “Stolen Vehicle Services” for Ford F-Series trucks in 2024, which included a dedicated number with real-time agents that connect with law enforcement to track and recover stolen vehicles, Scace said.

The 2025 F-Series trucks offer the “Ford Security Package,” in which vehicle owners receive theft alerts and can remotely disable their truck through the FordPass app, even if someone has an authorized key nearby, he said.

“Over time, we will expand these features to other Ford vehicles,” he said.

Another product that could be used to block access by this device is offered by mechanic Ryan Jaipal of Durham Autohaus in Pickering, Ont.

Jaipal says he has customers call every day to make sure the car they’re replacing isn’t as vulnerable as the car that was stolen.

“This customer has already had his vehicle stolen twice,” said Jaipal, motioning to a Porsche 911 in his shop. “I can’t even count how many calls and emails I get a day.”

He recommends the Igla, which is a small device that can be installed in a car that requires a password to put the car into drive.

With this installed, the device could clone a key, but it would be useless unless the driver also entered the password.

CAA’s Silverstein said he believes the federal government should consider limiting the device we ordered and also called on automakers to improve the security of their vehicles.

“It doesn’t take very long to use these tools to get access to cars,” he said. “And because manufacturers haven’t tightened security standards enough, consumers are vulnerable.”

For tips on car theft or any other story please email Jon Woodward.