Tesla Model 3 rental was stolen by reusing authentication key, thief caught days later in another state

Tesla thefts have come into focus over the past few weeks following a string of thefts in Europe.

Now we’ve learned of an interesting new theft in the US where a suspected thief managed to steal a Model 3 from a rental company.

The vehicle was stolen from Trevls, a Minnesota-based electric vehicle-only car rental company.

We reported on Trevls earlier this year when they deployed a fleet of 20 Tesla vehicles during Super Bowl week.

John Marino, the owner of Trevls, told the local Fox station that a 21-year-old man walked up to one of their Model 3’s at their Mall of America location in Bloomington and he was able to unlock and start the car:

“I don’t think it’s that easy. I think this guy had a next level of information on how to do it.”

The suspect was a regular Trevls customer.

Marino added:

“We suspected it was him because he used to brag a lot about how much he knew about the car and its security, and this was somebody who had the wherewithal to make this happen,”

The police believe that “the man somehow manipulated the Tesla app to unlock and start the car, disabling the GPS before leaving town.”

Computer forensics specialist Mark Lanterman commented on the case and said that he believes the suspected thief was able to make Tesla add the vehicle on his Tesla account:

“What it sounds like this person may have done is convince Tesla to take the VIN number of that vehicle and add it to his Tesla account. By doing that, you can do that with a phone call. By doing that, you can now control the Tesla from an app on your phone.”

Tesla sometimes does that for Tesla owners with loaner vehicles to enable the features of the mobile app, like unlocking and starting the vehicle without the key.

The automaker told Electrek that the suspect managed to enter the car because he had a phone that was already authenticated as a key due to his previous rental of the vehicle.

Earlier this year, Tesla released an update to help Model 3 owners managed who have access to their vehicles through their phones, but the owners need to actively manage them and remove access.

Trevls CEO John Marino told Electrek that they did remove access to the vehicle after the suspect’s previous rental and he doesn’t know how he was able to reinstate the authentication.

We contacted Tesla about the situation and we will update if we get an answer.

Marino told Electrek that he wasn’t able to live track the stolen Model 3 through the app because the suspect disabled GPS tracking, but he was able to know when and where the suspect was stopping to charge at Tesla Supercharger stations through Tesla’s online Supercharger billing system.

He fed the information to the Bloomington police who worked with other law enforcement to track him and he was eventually arrested near Waco, Texas two days after stealing the vehicle.

The theft was added to Tesla’s already pretty good stats in the US. We recently learned that stolen Tesla vehicles in the US have almost all been recovered: 112 out of 115.

As we reported last week, Tesla has been recently rolling out extra layers of security with ‘improved cryptography’ key fob and optional ‘PIN to Drive’ feature, which hasn’t made it to the Model 3 yet.