Freelander 2014, Relay Attack

Hi

I am new to these forums but my beautiful 2014 SD 2.2 FREELANDER was stolen on May 8th this year. It was recovered by the police on May 12th, the thieves drove it for 50 miles. I loved this car it was my 3rd freelander and simply the best car I have ever driven. From the heated steering wheel to the beautiful HSE sign on the back. It has 56,000 miles on clock, with full service History. The cost to put it right is £6,500 ...this insurance company Liverpool Victoria are refusing to pay because:

1. They can't understand how the thieves entered my car when it was locked.

2. No sign of forced entering on the car whatsoever..no broken window or steering damage.

3. The insurance company had HOOPERS examine it and they stated my keys are the original but this model is not capable of a relay attack. IS THIS TRUE? I REQUIRE HARD CORE EVIDENCE...PLEASE...

The insurance company on June 20th asked me in a letter :

1. How entry to your vehicle could have been gained?

- 2. Whether your vehicle had been left unlocked when it was stolen?

Since the day I reported it stolen , I know I locked that vehicle, I loved that car and had 15 folders in the back that are vital to my job. I am a meticulous person when it comes to security amd hold a responsible job and have done since 1995. I am 55 years old and have never made an insurance claim in my life. The insurance company have treated me like a criminal and land rover Redditch where the car has been sitting for 3 weeks have confirmed that this model CAN BE RELAYED ATTACK but insurance company are refusing any evidence others than Hoopers..who security car lock experts.

Please help me of can.

Whilst our enquiries into your claim continue we must reserve our rights under the terms of the policy, pending further investigation. This means that the claim, in whole or part, may not be covered. Therefore, your cooperation is really important.



We’re unable to pay a claim if a claimant or any person acting for them uses false or exaggerated information to make a claim and we report any fraudulent activity to the police.

They also wrote this at the end of the letter, which i find astonishing.

Russell2005

H Russell.
Hopefully and i am presuming that you have full comprehensive insurance, if so tell your insurers you would like to use the legal team and or solicitors within the insurance to take the matter to court, so they can decide, and that Landrover are saying the car can be RELAYED ATTACKED, your legal team will then get a proper report from Landrover to be used in the case.

They are trying it on and bulling you don't let it happen, i would bet no sooner you mention the legal team they will back down, et them report you to the police which they won't because you have nothing to hide good luck.

So theres no sign of forcing the doors or bonnet? Where was it parked when stolen and did they have time to work on it there?

No sign of forced entry , I have made that clear, no broken windows, no forced locks. They drove up along , parked adjacent to my land rover which was parked outside on a main rd! Got into it easily and started it easily and were gone in 20 seconds. It is all on CCTV....

Does the cctv show the hazard lights flash twice before they got into it? Also the front white lights and tail lights coming on briefly?
What damage was done that needs 6k5 sovs to repair?
How long have you owned the car?

Look the Garage and Land Rover have explicitly stated that it was a Relay Attack...how else could they have started it, I had both keys!

Russell2005 said:

Look the Garage and Land Rover have explicitly stated that it was a Relay Attack...how else could they have started it, I had both keys!

Click to expand...

Calm down yer muppet. I have been around freelanders for far too many years. I know of 2 occasions of this happening before. I edited the above post after the initial reply, which you may not have seen, to add some specific questions.

Does the FL2 have keyless entry? That would be the first requirement for a relay attack.
Can the FL2 be started with the wrong key / no key in the slot but with the correct (or relayed key) present?
Do you know if the 50 mile drive was one trip, as once started by a relay attack the car will run until switched off and then obviously can't be started unless a key is present.

A FL2 can not be relay attacked. That's assuming the OP's meaning of 'relay atrack' is where they amplify the signal from the fob, to the car, to make the car think the fob is near it to unlock it, then start it. Betterer known as 'keykess entry' like what a Disco 4 has. You often see video's of theives scanning a house for the key signal. They amplify it to the car, which then unlocks as the strength of signal makes it assume said key is near enough to unlock and start it. Newer versions if keyless entry have methods of protecting against this.

FL2's have never had keyless entry from the factry standard build. The OP's car is a later FL2 which has a fob and no dash slot. If you put the fob next to a locked FL2 which its paired too, it won't auto unlock like a D4 will. You have to press the unlock button on the fob. So relay attack is not posdible without said button pressed, as opposed to how D4's are stolen via keyless entry. Once unlocked the FL2 senses for the fob to be inside it. If so, it will start if you press the brake pedal and press start. Thats assuming all start conditions are met, like gearbox in neutral or park if its an auto. You can trick the car into thinking the fob is inside if you have the right kit to do it. Hence why the insurance is asking if it was unlocked, and I asked if the cctv shows the light sequence of unlocking.

Hippo said:

A FL2 can not be relay attacked. That's assuming the OP's meaning of 'relay atrack' is where they amplify the signal from the fob, to the car, to make the car think the fob is near it to unlock it, then start it. Betterer known as 'keykess entry' like what a Disco 4 has. You often see video's of theives scanning a house for the key signal. They amplify it to the car, which then unlocks as the strength of signal makes it assume said key is near enough to unlock and start it. Newer versions if keyless entry have methods of protecting against this.

FL2's have never had keyless entry from the factry standard build. The OP's car is a later FL2 which has a fob and no dash slot. If you put the fob next to a locked FL2 which its paired too, it won't auto unlock like a D4 will. You have to press the unlock button on the fob. So relay attack is not posdible without said button pressed, as opposed to how D4's are stolen via keyless entry. Once unlocked the FL2 senses for the fob to be inside it. If so, it will start if you press the brake pedal and press start. Thats assuming all start conditions are met, like gearbox in neutral or park if its an auto. You can trick the car into thinking the fob is inside if you have the right kit to do it. Hence why the insurance is asking if it was unlocked, and I asked if the cctv shows the light sequence of unlocking.

Click to expand...

Thanks, gives us all a better understanding and possible ways to help. I've heard of an instance where someone sent cctv footage to insurance company to help after a theft only for the insurance company to cancel the claim because of the lights not flashing, showing it was unlocked. Personally I'd only tell the insurance what they need to know as it's easy to stitch yourself up.
Reviews of hoopers don't seem good, as they are a loss adjuster company looking for ways out for the insurance companies.

The only way the FL2 can be stolen, is with a key coded to the vehicle, or some very expensive equipment. For it to be stolen in 20 seconds, it suggests that they had a duplicate key. However if they did, why dump it 50 miles away? Unless they were waiting for the search to cool off before moving it to a chop shop or export location. If exporting it, why cause £6k worth of damage to it? Too much about this seems iffy to me.

The OP said he has both keys. He doesn't know if he has ALL the keys. Hence the questions I asked earlier.

Hippo said:

The OP said he has both keys. He doesn't know if he has ALL the keys. Hence the questions I asked earlier.

Click to expand...

I'm thinking that it's possible there's another key for the vehicle. We don’t know if the vehicle was definitely locked, and there was no mention of the indicators flashing on the CCTV evidence showing it either being unlocked, or the alarm sounding, so it can only be assumed that the vehicle wasn't locked. Unlocking a locked FL2 without the remote fob or emergency key isn't easy or quick or quiet or damage free, and starting it without a valid key is all but impossible in the 20 seconds that the theft took place. So it can only be assumed the vehicle was left unlocked, and somehow still happy that the key was nearby.

Well the OP hasn't answered my questions but he will be watching.

Lv will intimidate you as standard. Yer making a claim. Too easy to put in a false claim. They will put the frighteners on yer as standard. I've had dealings with their investigators before on stuff that's nowt to do with me. They're not the brightest. Even when told multiple times. They will be looking to get out of paying up. Look at the fine print in yer contract to see if yer covered for making mistakes like leaving it unlocked.

Yer say it was locked. You ain't answered me question about hazard lights flashing. They would if it was unlocked with the fob. If they used the secret emergency access via the front left door handle, when the car battery was charged, and opened the door of a FL2, it would have triggered the alarm and hazards. Thats assuming it were locked with the remote fob prior to this.

As above I wondered if there was a 3rd fob. You can start a FL2 with diagnostics but its not straight forward. Not going into detail on this but they ain't getting in it with no damage and starting it in 20 seconds. No chance.

No damage entering but 6k5 sovs damage claimed on insurance. One can only assume they crashed it. Stuffed the engine and/or the gearbox. Or ripped the interior apart. Or the air bags popped. They're not cheap to replace. Well over 1k sovs to replace if they all pop.

Need hard core evidence. Yer been told by a talking hippo online. What more does one need.

Landrover Redditch are wrong if they say a standard FL2 can be relay attacked. They're stooopud to say this. If they think they're hard enough they can sue me. There must be a mistake in communications. What they have advised is rubbish. I'll go there and demonstrate my FL2 to them. Would make a funny youtube video. You have to press the unlock button on the fob, or use the secret access emergency key in the left hand front door. It can easily be proven on any factry fit standard FL2. I would be very surprised if someone had changed the security system away from standard. I wonder if they're getting mixed up with other lr models.

Hoopers have advised the fobs are origional. Big of them. They should have done a betterer job and gone further to say they're the only 2 fobs logged in the cars computer. As above I also think they may have stole it with a 3rd fob. Unusual but not if you had access to the car to add a fob prior to the theft. How long ago was it last in a car garage. Someone could easily have added a fob unkown to you. Easy to do. Well known in the trade. Hire a car from hertz. Add a key and tracker. Give it back and nick it after a while from someone else while they're hiring it.

But it won't help yer cause if the theif removed the 3rd fob from the computer if there was one. Hence found with only 2 fobs active. You say you have both fobs but have you checked they both still work. If one doesn't then it may have been deleted in favour of another, as opposed to 3 fobs being registered at the same time.

I'm suspicious of the whole post if I'm honest.
There are too many questions unanswered, and when challenged the OP got ****ty and never returned.

We all know that the Freelander can't be "relay attacked", as the electronic handshake must take place between a valid fob and the vehicle in order for it A to be opened, and B to be started.
There's no mention of the lights flashing on opening, in fact the question was ignored, so I'm suspicious about it. It could well be someone trying to get one over on the insurance company, and they're not buying it, so he's come here for proof it can be stolen quickly, which we know it can't.