Article

Key control for auto dealerships: Minimizing vulnerabilities and maximizing protection

Improvements in vehicle security and technology, with more sophisticated anti-theft alarm systems and disablement features, have changed the way in which vehicles are stolen.

Improvements in vehicle security and technology, with more sophisticated anti-theft alarm systems and disablement features, have changed the way in which vehicles are stolen. Along with “hotwiring” vehicles, thieves are not only stealing physical keys, but also stealing the signal transmitted by keys electronically (also known as “relay” or “keyless” car theft).

It is vital that auto dealers and management emphasize the importance of a good vehicle key control system, as weaknesses in a dealership can be easily exploited.

A successful key control system will utilize effective security methods, tools, and procedures to keep track of keys. A number of specialized services and techniques exist to assist your business in effectively managing keys.

Elements of a key control policy program

Storage:

Keys should be stored inside a locked cabinet, key room, or electronic key machine, which will protect against fire, theft, and relay attacks in a secure area.
- To prevent relay attacks, keys should be stored in a Faraday cage/pouch/case whenever possible.
- The area where keys are kept should remain locked at all times when unattended and not accessible or visible to the public.
Keys are tagged and identifiable by staff, but are custom-coded to make it difficult for anyone not familiar with the keys to identify which keys are for what.
Key rings are tamper-resistant (sealed and tamper evident) so that keys cannot be removed or switched prior to return.
Keys should be stored in a non-centralized location (for example, not at reception or a room labelled as “Key Room”).
Keys should never be left in the ignition or anywhere inside of any vehicle (inventory, demo, parts vehicle, customer shuttle, etc.) while the vehicle is unattended.
Always store the second set or duplicate keys in a different location from the first.
Lock all keys, including that of vehicles in for service, keys for shuttle, parts, demo, and blocker vehicles, inside the electronic key machine, file cabinet, key cabinet, or key room.
Ensure that room doors and rooms where key machines, file cabinets, or key cabinets are located are of substantial construction, are locked at all times and are fitted with self-closing mechanisms.
Consider regularly changing the passcode on the electronic key machines and the electronic combination locks securing key rooms.

Recordkeeping:

An inventory of all dealership and vehicle keys should be taken daily.
All keys marked with a blind code number that does not reflect usage or corresponding vehicle.
Do not use standard key coding to mark keys.

Issuing keys:

An authorized manager should properly control all key orders.
Keys should only be issued on an as needed basis (not as a condition of employment).
Keys for test drive vehicles should be secured, with a key management system in place to check keys in and out.
Photo ID required upon issuance of keys to a customer/third-party.

Key return:

Keys are only to be returned to the issuing department by the authorized key holder.
Maintain adequate procedures for terminated employees (for example, hold final pay cheques or employee records upon the pending return of keys).
Key drop slots are secured with a baffle and substantial metal-locking rear box.
Vehicles are immediately inventoried, and keys are matched when vehicles are returned.

Lost keys:

Measures are in place to report when vehicle keys are reported or noted to be missing.

Audits:

Routine practices are reviewed from time to time to check for weaknesses in the key control system and that the system remains functional.
An independent annual audit process is in place.

Manually disable vehicles:

In case keys are bypassed, manually disable target inventory by removing starter or fuel pump relay.

A comprehensive key control system is necessary to minimize the risks associated with vehicle theft and address security issues in the shortest timeframe possible.

As always, please contact your broker or Marsh Advisory representative if you have any questions and concerns.