# Headlight attack: how it works and who is targeted _Updated: 8 November 2026_ **Short answer:** The headlight attack (CAN injection) is theft without a key: the thief connects to the headlight wiring and sends the car a fake message that the key is present. The car unlocks and starts, and the factory alarm often does not go off. The best-known targets are the Toyota RAV4, Land Cruiser and Lexus. > **The service we recommend: Immobiliser** The engine will not start without your fob or code, even with the key. We tell you the price when you tell us the model. [More about the service](https://autoindustrija.rs/en/services/immobiliser) ## How the headlight attack works The thief connects to the headlight wiring and through it sends the car a fake message that the key is genuine. The computers in a car talk over a network of wires. This network is called CAN. When you walk up with the key, the part of the car that receives the key signal reports over that network that the key is genuine. Only then do the doors unlock and the engine is allowed to start. In most cars on the road, the computers take that message on trust and do not check where it came from. Part of the same network also runs through the headlight, so the thief reaches it from outside. ## What the thief does, step by step 1. Removes part of the bumper or the plastic above the front wheel and pulls out the headlight connector. 2. Connects a device to the wiring. The device silences the real messages on that network, so the computers hear only the device. 3. The device sends a message that the key is genuine. The factory immobiliser, the protection that lets the engine start only with the right key, trusts that message and lets the engine start. 4. At the press of a button the device also sends an unlock message, as if you had pressed the button on your key. 5. The thief unplugs the device, gets in and drives the car away. The thief does not need your key, the key's signal or the OBD port. No door is forced and no window is broken. The car is driven away within a few minutes. ## What does not stop the headlight attack These protections work against other thefts, but not against this one: - **Factory immobiliser:** The fake message tells the car that the key is present, and the factory immobiliser trusts that message and lets the engine start. - **Factory alarm:** Nobody forces a door, and the car thinks you unlocked it yourself. That is why the alarm often does not go off. - **Key pouch:** The thief does not need your key's signal, only the wiring at the headlight. A pouch protects against keyless theft. [More about keyless theft](https://autoindustrija.rs/en/advice/keyless-car-theft) - **OBD protection:** The thief connects to the wiring at the headlight, from outside, and does not touch the OBD port at all. OBD protection still protects against a different theft: making a new key through the port under the steering wheel. [More about OBD protection](https://autoindustrija.rs/en/obd-protection) ## An immobiliser helps against this attack An add-on immobiliser is a separate small device we fit alongside the factory one. The engine starts only when the car has both the genuine key and your confirmation. The thief does not get that confirmation from a fake message through the headlight wiring, so even with the car unlocked, the thief cannot drive it away. The device is hidden among the car's wiring. You carry the fob in your pocket, so the engine starts as before. [More about the immobiliser](https://autoindustrija.rs/en/services/immobiliser) ### What else helps - **An alarm with an engine lock:** An alarm that only sounds does not stop the thief. An alarm with an engine lock asks for your fob, so the engine will not start even when the car thinks the key is present. [More about alarm installation](https://autoindustrija.rs/en/services/car-alarm-installation) - **A steering column lock:** The fake message opens the car, but not the lock. The thief has to cut it, which takes time and is loud. [More about the steering column lock](https://autoindustrija.rs/en/advice/steering-wheel-lock) - **GPS tracking:** GPS does not prevent theft, but it tells you as soon as someone moves the car and shows where it is. Thieves switch off or dump any GPS unit they find, so it should be hidden, under the trim. [More about GPS tracking](https://autoindustrija.rs/en/services/gps-vehicle-tracking) - **A locked garage:** Leave the car in one when you can. The thief needs a few undisturbed minutes next to the car for this attack. ## Which cars are targeted The headlight attack is known from Toyota and Lexus. The device was sold for the Toyota RAV4, Prius, Highlander, Land Cruiser and GR Supra and for the Lexus ES, LC, LS, NX and RX. [More about protecting a Toyota or Lexus](https://autoindustrija.rs/en/brands/toyota) This is not a weakness of one make only. Other makes also have models that can be stolen the same way. **Is your car a target: it depends on where the wiring runs** - The thief picks a car whose network wiring runs close to the outside: at the headlight, behind the plastic above the wheel or at the rear light. Cars stolen this way mostly do not stay in the country. Thieves change the plates and the chassis number and ship them abroad in a container. [More about the most stolen cars in Europe](https://autoindustrija.rs/en/advice/most-stolen-cars-in-europe) ## A removed headlight can be a theft attempt A bumper pulled away, a removed headlight or pulled-out wiring at the headlight can be a theft attempt. Report it to the police on 192. Before one RAV4 was stolen, the owner twice found the headlight removed and the wiring pulled out, and thought it was vandalism. A couple of days after the second time, the car was gone. ## Frequently asked questions ### Can the car maker close this way of stealing? Yes, with new software in the car's computers. A quick change stops today's device until thieves rework it, and full protection takes more work and time. An add-on immobiliser does not depend on that, because it asks for your fob or code. ### Does kasko pay for a headlight attack theft? Yes, if theft is in the package you bought. You still have the keys, so hand them all over when you report the theft. If one is missing, the insurer treats the car as having been unlocked. [More about kasko and theft](https://autoindustrija.rs/en/advice/comprehensive-insurance-car-theft) ### What do I do if the car is stolen anyway? Call the police on 192 straight away and give an exact description of the car. Tell your insurer within 3 days at the latest, and some insurers ask for a report within 24 hours. If the car has GPS, give the location to the police. [More about what to do when your car is stolen](https://autoindustrija.rs/en/advice/car-stolen-what-to-do) Have a question about your car? Message us on WhatsApp or call 067 774 1606. ## Read also - [Car theft in Serbia: 9 ways thieves steal a car](https://autoindustrija.rs/en/advice/how-cars-are-stolen-in-serbia) - [OBD car theft: how thieves make a new key](https://autoindustrija.rs/en/advice/obd-car-theft) - [Keyless theft (relay attack): how it works, how to stop it](https://autoindustrija.rs/en/advice/keyless-car-theft) --- Page on the website: https://autoindustrija.rs/en/advice/headlight-can-injection-theft auto-industrija, Belgrade. Phone and WhatsApp: +381677741606. E-mail: kontakt@autoindustrija.rs.