How can a thief beat PATS???

[rabidgoldfish]

My 09 Escape was stolen. I watched the thieves on video. They appeared to be looking at the VIN, as I could see a small circle of light on the truck. Then, 2 other guys walked up, got in, started it and left. The whole thing took under 3 and a half minutes. I recovered the car later, as they dumped it near by. There was no damage or evidence of break-in.

So, my question is how could they have beat the PATS system?? My understanding is that you need the key FOB programmed for that specific vehicle in order to both bypass the alarm and start the car. Any ideas?

 

[Goofyexponent]

I heard it once passed around in an email, that if a theif has your VIN, they can simply go to the dealership and request a key.

I thought it to be bogus, so I tried it.

I went to my local chevy dealership and said I had locked my ONLY set of keys in my Buick Park Avenue Ultra. I gave them my VIN, and they had me a key cut and coded within a couple hours.

I came home, stuck it in the door, it opened. I jammed the key in the ignition and it fired right up.

ALl this withont so much as ONE piece of ID.

I usually keep a booklet, reciept or ANYTHING over my VIN number. The law says you can't modify or relocate your VIN plate, but it don't say anything about covering it with something.

The guys most likely had your key cut at a local dealership (or several) and just had to match your VIN with the key they had cut.

 

[1Aauto]

Welcome to the site.

 

[com4tably.numb]

By looking up your vin in a database, it will give the "Code" to which your key is cut. You can then cut two fresh keys, and use a Ford programmer connected to the ODB port to program the PATS to accept the RFID transponders in the key as valid.

Back in the day, I would say your theif was someone who worked inside the auto business. BUt this is all pretty much publicly available knowledge now, you can buy portable "code" key cutters pretty cheap over the internet.

A quick google search led me to this on the motorcraft site, takes your vin and outputs the key "Code". Now this is a subscription service for "Automotive Security Professionals". But people steal passwords all the time, and even some "professionals" are dishonest.
http://www.motorcraftservice.com/vd...code_lookup&gutsid=keycode_lookup&kevin=rules

 

[NICE59FORDF100]

It's possible that they could have had key's physically cut to open the door, but as far as programmng the key to the vehicle, that takes a MINIMUM 10 minutes. See, whether it be NGS, WDS, IDS, or the aftermarket type scanners for locksmiths, PATS requires a 10 minute security lock out proceedure to prevent this exact thing. Even the techs in the shop have to wait the 10 minutes before they can pair keys with the vehicles. So, the only way they could have started the vehicle is with a key that was perviously programmed to your vehicle. and easy way to tell is to take it to a dealer and ask them to look up in the vehicles PATS system how many keys are programmed to it. Whatever module the PATS functions are stationed in (In your case, the Instrument Cluster), there is a PID (Parameter Identification) value in there that is something like KEYS_#_PROG (or similar) that will say how many keys are in fact allowed to start that vehicle. If it is more than 2, i would suspect whatever shop had the vehicle last (Just my opinion)

EDIT:
I have said all this of course, assuming (and hey, im not accusing anyone of anything here, but we have seen this in the past on this forum) that you are not in fact a theif wanting to try and steal a vehicle and using the original post as a way to find how how to infact do it Not trying to start a fight or anything by any means, but covering ALL bases Cheers!

Second Edit:
Any reputable dealer, before sending a request for a key code, will ask for proof of ownership, driver's license, and/or copy of insurance/registration.

 

[rabidgoldfish]

Thanks, but I am still mystified. Oh - and I am not a thief. It literally took under 3 and a half minutes to get in and drive off in the car. My dealer tells me that a key blank will get them in the door, but the transponder code must match my vehicle in order for the vehicle to start. Clearly, the car was started and driven off.
There is no way that I was targeted by someone with a copy of my key, as I was on my way in from out of state and parking in a secured lot 10 miles from my home. I have heard of devices used to steal info off credit cards that use RFID chips that can work by walking near someone. Maybe this PATS code could have been taken from me by a pedestrian when I parked? Puzzling.