Motion key fobs - do you have one?

[Spidergears]

Ran across a post on Reddit post where a user claimed that Ford uses a motion sensitive key fob for most 22/23 ford models.

According to this user,

“Most 22-23 models. If the key FCC ends in 338 or 339, it's the new motion key.

If the FCC ends in 2300 or 2600, they are the older style that is vulnerable.”

The user also went on to say that Ford sometimes drops the trailing zeros. Mine ended in ‘26’ and with testing it doesn’t seem to stop transmitting even after sitting for a few minutes. The fcc is in tiny print where you remove the accessory key. I had to use the iOS magnifier app to read it.

So, my question is, does anybody have a motion sensitive key fob for their gen 14? I Assume id just have to figure out how to buy one. I did some googling and could only find references to these motion sensitive key fobs in Europe.

Honestly, I don’t understand why there isn’t a simple switch to disconnect the battery. Wonder how hard that would be to add. I’d pay for that.

Sponsored

 

[fordtruckman2003]

Key fobs should always be motion sensitive but that would probably cost Ford more money. I don't know if they are but I keep fobs far from the truck. Only the fob that I use on regular basis has battery in it.

 

[antho]

All 3 of mine end in 426 ?

 

[Highway 11]

My keys end in 426. Not motion sensitive. Tried an aftermarket motion sensitive module and the keyfob randomly would just not work until I removed it.

I have an OBD lock, a faraday box, my VIN is obscured, and for when I go to the city, I have a steering wheel club. Caveat: I live in Ontario, currently in a vehicle theft epidemic, and I work in law enforcement.

Food for thought:

Gen 14 F150s are not frequently stolen here in Ontario when locked. The prize of the day is typically a Toyota Highlander or a Ram 1500. But something's changed in the last few weeks.

Reports of Gen 14 F150s being stolen have started surfacing here. Common theme is in the middle of the night and the keys are accounted for. Probably a relay attack, right?

On January 7th, 14 Ford Edges were stolen overnight from the Oakville Assembly plant.

My concern is that someone's figured out an exploit in Ford's otherwise surprisingly secure security.

 

[Spidergears]

@Highway 11 - yikes.

Whats the need to obscure the vin?

 

[Kodiak]

Mine (2022) does not list any number as FCC. 3 sets of numbers but no FCC listing.

 

[Highway 11]

@Highway 11 - yikes.

Whats the need to obscure the vin?

The VIN is used to cut an unauthorized key to gain entry into the vehicle so that a thief can get access to the OBD port to program a new key. For a while it was recommended that one obscure the VIN to make that harder. You'd see countless videos of thieves walking up to cars, taking a photo of the VIN, and coming back an hour or two later to steal the car.

However, it keeps the dumb ones at bay. The smart ones get the Carfax app and add your licence plate, which gives them the VIN without even having to approach your car.

 

[labjr1]

My 2023 Platinum PB ends in 426 so not motion sensitive.

 

[rpold150]

The VIN is used to cut an unauthorized key to gain entry into the vehicle so that a thief can get access to the OBD port to program a new key.

I'm surprised that access to OBD is all that is needed. Going into the Ford dealer and going through the normal steps usually requires 1 or 2 other key fobs present in order to make a new one. So plugging into OBD can somehow bypass all that? That's not good.

 

[HammaMan]

I have an OBD lock, a faraday box, my VIN is obscured, and I work in law enforcement.

Ford susceptible to relay attack, furthermore your tag can be used to obtain your vin for free. It's easy to do in the US, haven't tried canadian. Not sure how an OBD lock works, but it readily slips out of its metal retention bracket.

 

[Highway 11]

I'm surprised that access to OBD is all that is needed. Going into the Ford dealer and going through the normal steps usually requires 1 or 2 other key fobs present in order to make a new one. So plugging into OBD can somehow bypass all that? That's not good.

Keep in mind that's not universal across all makes. It's not uncommon for thieves to be arrested with key programmers and a plethora of blank keys awaiting programming.

As well, if they're not programming new keys, they may be attacking the CANBUS system. See the article below:

https://www.autoblog.com/2023/04/18...NPZg_LhQWVP-oD4l8htpc7YFnZBXSF3wSiXb7IxlXeSe8

And if you want a video of the CANBUS attack:



You build a better car, the universe builds a better thief. Pursuing stolen vehicles up here is generally prohibited and if caught the justice system is fairly lenient. It's a low risk / high reward venture. With increased security measures, you're now seeing thieves getting bolder and committing break and enters while owners are at home sleeping to get at keys, or straight up carjacking owners of valuable vehicles.

Ford susceptible to relay attack, furthermore your tag can be used to obtain your vin for free. It's easy to do in the US, haven't tried canadian. Not sure how an OBD lock works, but it readily slips out of its metal retention bracket.

You are correct that the Fords without a motion sensitive fob are still susceptible to relay attacks. In Canada, you can use Carfax to find the VIN associated with the plate as well. The obscured VIN is more for keeping the dumb ones / ones looking for a quick score away. You'll find quite a few publicly available videos of thieves walking up to a car, taking a photo of the VIN, then returning some time later that day to steal the vehicle. Anything little bit helps in my view.

The OBD lock is a two piece lock with recessed security screws keyed to that particular lock holding it all together. You have to destroy the OBD port to get if off.

Here's a Reddit post from an F150 owner whose vehicle was broken into but the thieves abandoned it after failing to get the lock off.



What insurance companies are mandating for some frequently stolen models is the installation of the Tag tracking system. It's a series of RFID tracking fobs epoxied to the vehicle in several hidden locations. Think Lojack on steroids. It's something on my list to research.

I guess the point to all the steps I've taken is to make my truck enough of a pain in the ass to take that the Ram 1500 next door and the Lariat down the street start looking like a better idea. But if they take it, they take it. Can always get a new truck. Can't get a new life.

 

[rpold150]

You build a better car, the universe builds a better thief.

I think this says it all. There is obviously a lot of money to be made and with so little consequences. It's a job anyone can have without worrying about having a good credit score or clear background check. I hate to feel like it's inevitable so why try to prevent it. So, like you say, every little bit helps to make your vehicle look less desirable than the one next door.

Thanks for all the info.

 

[kb2755]

The VIN is used to cut an unauthorized key to gain entry into the vehicle so that a thief can get access to the OBD port to program a new key. For a while it was recommended that one obscure the VIN to make that harder. You'd see countless videos of thieves walking up to cars, taking a photo of the VIN, and coming back an hour or two later to steal the car.

However, it keeps the dumb ones at bay. The smart ones get the Carfax app and add your licence plate, which gives them the VIN without even having to approach your car.

I’ve also obstructed my vin and use a faraday box. My relatives lost a GMC and the police claimed it was using the vin. Greater Toronto Area, so the odds are higher than where I am, but doing what I can to make it harder on whoever tries. Come to terms that if they’re competent and want it, little that can be done to guarantee prevention.

 

[Atlee]

Ran across a post on Reddit post where a user claimed that Ford uses a motion sensitive key fob for most 22/23 ford models.

According to this user,

“Most 22-23 models. If the key FCC ends in 338 or 339, it's the new motion key.

If the FCC ends in 2300 or 2600, they are the older style that is vulnerable.”

The user also went on to say that Ford sometimes drops the trailing zeros. Mine ended in ‘26’ and with testing it doesn’t seem to stop transmitting even after sitting for a few minutes. The fcc is in tiny print where you remove the accessory key. I had to use the iOS magnifier app to read it.

So, my question is, does anybody have a motion sensitive key fob for their gen 14? I Assume id just have to figure out how to buy one. I did some googling and could only find references to these motion sensitive key fobs in Europe.

Honestly, I don’t understand why there isn’t a simple switch to disconnect the battery. Wonder how hard that would be to add. I’d pay for that.

What is a motion sensitive fob supposed to do?

 

[HammaMan]

Keep in mind that's not universal across all makes. It's not uncommon for thieves to be arrested with key programmers and a plethora of blank keys awaiting programming.

As well, if they're not programming new keys, they may be attacking the CANBUS system. See the article below:

https://www.autoblog.com/2023/04/18...NPZg_LhQWVP-oD4l8htpc7YFnZBXSF3wSiXb7IxlXeSe8

And if you want a video of the CANBUS attack:



You build a better car, the universe builds a better thief. Pursuing stolen vehicles up here is generally prohibited and if caught the justice system is fairly lenient. It's a low risk / high reward venture. With increased security measures, you're now seeing thieves getting bolder and committing break and enters while owners are at home sleeping to get at keys, or straight up carjacking owners of valuable vehicles.



You are correct that the Fords without a motion sensitive fob are still susceptible to relay attacks. In Canada, you can use Carfax to find the VIN associated with the plate as well. The obscured VIN is more for keeping the dumb ones / ones looking for a quick score away. You'll find quite a few publicly available videos of thieves walking up to a car, taking a photo of the VIN, then returning some time later that day to steal the vehicle. Anything little bit helps in my view.

The OBD lock is a two piece lock with recessed security screws keyed to that particular lock holding it all together. You have to destroy the OBD port to get if off.

Here's a Reddit post from an F150 owner whose vehicle was broken into but the thieves abandoned it after failing to get the lock off.



What insurance companies are mandating for some frequently stolen models is the installation of the Tag tracking system. It's a series of RFID tracking fobs epoxied to the vehicle in several hidden locations. Think Lojack on steroids. It's something on my list to research.

I guess the point to all the steps I've taken is to make my truck enough of a pain in the ass to take that the Ram 1500 next door and the Lariat down the street start looking like a better idea. But if they take it, they take it. Can always get a new truck. Can't get a new life.

Can you post up the mugshots (or link) to those being arrested for this?

Sponsored