Toyota has a reputation for sensible, reliable cars. It is now also one of the makes UK thieves take most often, and insurers and police in the Netherlands, France, Belgium and Germany put the same models at or near the top of their theft lists.

Toyota is now the UK's third most stolen make

Loss adjuster QuestGates analysed DVLA data obtained under Freedom of Information and ranked the most stolen makes of 2025 as Ford, BMW and Toyota. It also found private car thefts fell 13.30%, from 61,857 in 2024 to 53,629 in 2025. Toyota moved up to third while theft overall fell, taking the place of Land Rover, whose thefts dropped by almost 30%.

Toyota's total depends on whose analysis you read. What Car? counts 4,518 stolen Toyotas in 2025, while MotorEasy puts the make at 5,475. Treat the MotorEasy totals with caution: the same article estimates around 60,900 cars stolen and a 12.8% rise, which contradicts the falls in the other DVLA-based analyses. All three place Toyota third, and the full 2025 make and model table sets the three analyses side by side.

The rise did not start in 2025. LV= claims data showed Toyota thefts up 103% between 2021 and 2023, the second-largest rise in its figures. The largest, at 513%, was for Lexus, Toyota's premium brand, which has its own guide to Lexus theft risk by model.

RAV4 and C-HR: the two Toyotas UK thieves target most

MotorEasy's 2025 model list has 1,328 RAV4s and 962 C-HRs stolen, fourth and eighth overall. In 2024, DVLA data obtained by What Car? and Tempcover recorded 1,260 RAV4 thefts, fifth on the list.

At trim level the C-HR stands out. Tempcover's analysis of DVLA data found the C-HR Dynamic HEV CVT was the UK's most stolen single variant in 2025, with 437 thefts, up 28% from 342. The C-HR Excel HEV CVT was eighth with 253, up 39% from 182.

The Fiesta is still the most stolen model, but its thefts are split across many trims; its most stolen version, the Zetec, had 425. C-HR thefts are concentrated in two hybrid versions, so one of them tops the variant list.

Counts also reflect how many of each car are on the road, so a rate per registered car gives a fairer comparison. DVLA FOI response FOIR12391 covers cars first registered in 2022-2024 and stolen in the same window. On that data the RAV4 was stolen at 12.4 per 1,000 registered (284 of 22,899), the C-HR at 3.5 and the Toyota make at 2.8, against 2.1 for all cars of that age. We calculated these rates from the FOI figures; the DVLA did not publish them.

In the West Midlands, Toyota thefts rose 75% in 2024, from 585 to 1,021, a rate of 13 per 1,000 registered Toyotas. The stolen vehicle recovery company Tracker names the RAV4 among thieves' favourite models and lists Toyota among the brands that dominate its recoveries.

The same pattern across Europe

Netherlands. The insurers' vehicle crime bureau, Stichting VbV, recorded the RAV4 (2019 on) as the most stolen car of 2025, with 387 thefts, up 13%. Yaris Cross thefts rose 371% and Corolla Cross thefts 82%. Toyota was the most stolen brand, with 1,102 cars against 852 in 2024.

In the first half of 2026, RAV4 thefts fell 43%, from 144 to 82, and the Corolla Cross took the top spot with 87. That suggests thieves moved to another Toyota rather than away from the brand.

France. Insurers' theft bureau Argos and France Assureurs ranked the RAV4 V as the most frequently stolen car of 2025, with the C-HR third. Across all makes, 70% of 2025 thefts involved no visible forced entry.

Belgium. Federal Police figures reported by La Dernière Heure show 106 RAV4 thefts in 2023 and 531 over 2019-2023. Toyota was the fifth most stolen brand over those five years, with 1,862 cars.

Germany. The insurers' association GDV counts thefts per 10,000 insured cars, so its figures are not directly comparable with the UK rates above. In 2024 the fourth-generation Land Cruiser ranked second at 104 per 10,000 and the fifth-generation RAV4 sixth at 77. Toyota-group models, including Lexus, took four of the top ten places and all of the top three. A year earlier, the Land Cruiser led the 2023 list at 160 per 10,000.

How the headlight CAN injection attack works

The best-documented method used on the RAV4 is CAN injection. Security researcher Ken Tindell of Canis Automotive Labs took it apart in 2023 after a RAV4 was stolen this way.

The CAN bus is the car's internal network. It carries messages between the engine, lights, body electronics and keyless entry. On the RAV4 Tindell examined, the smart-key receiver confirms a valid key with a message on that network, and the rest of the car trusts it. Thieves exploit that trust from outside the car:

  1. They pull back the front bumper to reach the wiring connector for a headlight, which is on the CAN network.
  2. They plug in a small device. In the case Tindell studied it was hidden inside a JBL Bluetooth speaker case, so it would look harmless if they were stopped.
  3. The device overrides normal traffic and sends fake messages claiming to come from the smart-key receiver.
  4. The car unlocks, the immobiliser releases and it can be driven away. The real key never leaves the house.

French insurers describe cars started through the wiring harness using devices disguised as speakers or phones.

Because the attack bypasses the key, a signal-blocking pouch does nothing against it. Nor does an OBD port lock, because the OBD socket is never touched.

Relay attacks and OBD key programming are still in use, and DVLA theft data does not record method. The Crime Survey for England and Wales found the remote-locking signal was manipulated in 46.7% of vehicle thefts in the year ending March 2025, but it does not separate out CAN injection, and that figure rests on a small sample of 51 incidents.

Where stolen cars go

Some stolen cars are broken up for parts; others leave the country. These figures cover all makes, not just Toyota.

In the Netherlands, VbV says 913 stolen Dutch vehicles were recovered abroad in 2025, the largest numbers in Germany (266) and Belgium (195). Recoveries in Ghana rose from 6 in 2024 to 26 in 2025, making it the only non-European country in VbV's top ten; VbV puts that partly down to its own project there. VbV also recovered 93 vehicles from shipping containers in 2025.

In the UK, of the stolen vehicles the National Vehicle Crime Intelligence Service (NaVCIS) intercepted for export in 2021-2024, 79% were SUVs and 52% premium or luxury makes. The top destinations were DR Congo (38.5%) and the UAE (20.1%). The RAV4, C-HR and Land Cruiser fit the SUV profile.

A stolen car is easiest to trace before it is broken up or sealed in a container.

What reduces the risk

Manufacturer updates. Security fixes can work. In France, the Lexus RX II and NX, second and third in 2024, left the 2025 top ten after their security was improved. We could not find a public list of which UK build dates are protected against CAN injection, so ask a Toyota dealer to check your car by VIN and confirm the answer in writing.

Steering or pedal locks. They do not stop electronic unlocking, but a thief still has to cut through hardened steel before driving off, which takes time and makes noise. Determined thieves can beat them, so choose one tested by Sold Secure and fit it every time you park.

Key storage. A signal-blocking pouch or a motion-sensor key helps against relay attacks. It gives no protection against CAN injection.

Parking. The headlight attack needs access to the front corner of the car. Parking nose-in against a wall, fence or your other vehicle makes that harder, and a locked garage is better still. CCTV can give police evidence but does not physically stop anyone.

OBD lock. It blocks key-programming tools at the diagnostic socket, a common route into many makes. It does nothing against the headlight route, so on a Toyota treat it as one extra layer rather than the main defence.

MeasureHelps againstDoes not stop
Signal-blocking pouch or motion-sensor keyRelay attacksCAN injection, OBD key programming
OBD port lockKey programming at the diagnostic socketCAN injection via the headlight
Steering or pedal lockA quick drive-awayElectronic unlocking; determined cutting
Nose-in parking or a garageAccess to the headlight wiringThieves with room to work
Hidden GPS trackerFinding the car after it movesThe theft itself

How a hidden GPS tracker fits

A GPS tracker is not an immobiliser or an alarm. It will not stop anyone unlocking, starting or driving your car. It alerts you when the car moves and shows where it is going, which gives you and the police a chance to locate it before it is stripped or loaded into a container.

More than half of stolen cars are not recovered. QuestGates found 44.94% of stolen cars were recovered in 2025, up from 42.48% in 2024.

How the tracker is fitted matters. Plug-in OBD trackers are easy for a thief to find and pull out. Fleetalyse's car theft protection setups use hidden wired units such as the Teltonika FMC920, which is 12 mm thin and can be fitted out of sight. It sends alerts for movement, towing (movement with the ignition off), unplugging and signal jamming. Plans start from £5.99 a month including VAT per vehicle, with a 14-day free trial and no setup fee.

You can compare our stolen vehicle recovery trackers, or read how tracker alerts and police reports work together in a recovery.

There are limits. A tracker needs GPS and mobile signal to report where the car is, police decide how and when to recover it, and you should never try to retrieve a stolen car yourself.

A hidden tracker, a manufacturer app and a recovery service compared

OptionWhat you getLimits
Manufacturer connected-car appConvenience features, such as finding where you parkedNot designed for stolen vehicle recovery; depends on the car's own telematics staying connected
Monitored recovery service, such as TrackerA monitoring centre that works with policeOngoing subscription
Self-monitored hidden tracker, such as FleetalyseMovement, towing, unplug and jamming alerts, with live locationMonthly plan (from £5.99 inc VAT); you report the theft and pass on the location

Questions owners ask

Is the RAV4 the most stolen Toyota in the UK?

On the model counts available, yes. MotorEasy has 1,328 RAV4s stolen in 2025 against 962 C-HRs. By individual trim, a C-HR hybrid variant topped the national list in 2025. In the Netherlands the Corolla Cross overtook the RAV4 in the first half of 2026, so owners of other Toyotas should not assume they are safe.

Does an OBD lock or key pouch stop the headlight attack?

No. A pouch blocks relay attacks and an OBD lock protects the diagnostic socket. The headlight attack connects from behind the front bumper and needs neither. A steering lock and nose-in parking do more against it.

Has Toyota fixed the problem on newer cars?

We could not find a public list of which UK build dates are protected against CAN injection. Ask your dealer to check your car by VIN and confirm the answer in writing.

Will a GPS tracker stop my Toyota being stolen?

No. It alerts you when the car moves, is towed, is unplugged or is being jammed, and gives you a live location to pass to the police. Use it alongside a steering lock, careful key storage and sensible parking.

About this guide: Fleetalyse sells GPS trackers. Every figure here comes from the named sources linked in the text and listed below, and the per-1,000 rates from DVLA FOI response FOIR12391 are our own calculations. Toyota and the other makes are named factually; none of them endorses Fleetalyse.

Sources