Could Your Car Be Hacked Through Your Phone? What You Should Know

There was a time when stealing a car meant physically breaking into it, whether by smashing a window, forcing a lock, or tampering with the ignition. Today, as vehicles become increasingly connected to the internet, some of the risks car owners face are no longer limited to what happens in the parking lot.

Many newer vehicles, including electric and hybrid models, come with smartphone apps that allow drivers to lock and unlock doors, check their vehicle's location, monitor battery levels, and sometimes even start the engine remotely. These features are undeniably convenient, but they also introduce new opportunities for cybercriminals.

A study conducted by researchers at the University of Gothenburg and Chalmers University of Technology in Sweden has highlighted how cybersecurity risks are changing as cars become more connected. Published in Software Quality Journal, the research examined 413 security vulnerabilities identified in automotive software between 2022 and 2024.

By comparing these findings with research from approximately a decade earlier, the team discovered a significant shift. In the past, most vulnerabilities were found in the computer systems operating inside vehicles. Today, a growing proportion are being identified in the external apps, websites, and online services that allow drivers to interact with their cars remotely.

According to the researchers, the proportion of vulnerabilities affecting these external systems has nearly tripled compared with the previous decade.

How Could Your Phone Put Your Car at Risk?

If you drive a relatively new car, you may already use an app that allows you to unlock the doors, turn on the air conditioning before a journey, check your fuel or battery level, or locate your vehicle in a crowded parking lot. But what actually happens when you press one of those buttons?

In many cases, the request travels from your phone to the manufacturer's online servers before being transmitted to the vehicle. Along the way, the system must verify that the person making the request has permission to access the car and perform the requested action.

When these security checks work properly, the process is both convenient and secure. However, vulnerabilities in the software or weaknesses in the way access is managed could potentially allow unauthorized users to obtain personal information. In more serious cases, certain flaws could enable someone to trigger vehicle functions remotely.

Srijita Basu, a researcher associated with the University of Gothenburg and Chalmers University of Technology, explained that some of the weaknesses identified were surprisingly familiar. These included unchanged default passwords and systems that lacked adequate protection against well-known cyberattack techniques.

In other words, some of the same security problems that have affected computers, smartphones, and websites for years are now appearing in connected vehicles.

One particularly concerning example emerged in December 2024, when it was discovered that data associated with approximately 800,000 electric vehicles from the Volkswagen Group had been exposed online for months.

The affected vehicles included models from Volkswagen, Audi, SEAT, and Škoda. The exposed information reportedly included location data collected by the vehicles, along with certain personal details linked to their owners.

Why is this information so sensitive? Because a vehicle's location history can reveal far more about someone's life than they might expect. Repeated location records could potentially show where a person lives, where they work, which places they visit regularly, and when their home is likely to be empty.

Importantly, the exposure of personal or location data does not necessarily mean that someone can take control of a vehicle. However, it demonstrates why the security of connected-car services matters beyond the vehicle itself.

How Can You Protect Your Car From Cybersecurity Threats?

The researchers emphasize the importance of designing vehicles so that internet-connected services are kept as separate as possible from safety-critical systems, including braking and steering. This helps reduce the risk that a vulnerability in an external service could affect essential vehicle functions.

For drivers, the findings don't mean that smartphone-connected car features should be avoided altogether. Most people can continue using these services while taking a few sensible precautions to protect their accounts and personal information.

Keep your vehicle's software updated. Car manufacturers periodically release software updates that may address security vulnerabilities as well as improve performance. Check for available updates and install them according to the manufacturer's instructions.

Use a strong, unique password. Your connected-car account should have a password that you don't use for any other website or service. If another account is compromised, a unique password makes it harder for someone to gain access to your vehicle's connected features.

Enable two-factor authentication. If your car manufacturer's app supports two-factor authentication, turn it on. This adds another layer of protection by requiring an additional verification step when someone attempts to sign in.

Download only official apps. Use your vehicle manufacturer's official app, downloaded from a trusted app store. Be cautious about unfamiliar third-party services that request access to your car account or vehicle information.

Review who has access to your vehicle. If you've sold your car, changed phones, or previously shared access with another driver, check whether old devices and user permissions are still connected to your account. Remove access that is no longer needed, and follow the manufacturer's account-transfer instructions when selling a vehicle.

Limit unnecessary data sharing. Review the privacy settings available through your vehicle and its companion app. Some connected services collect location information and driving data, so it's worth understanding what is being shared and disabling optional features you don't need.

As cars become more sophisticated, cybersecurity is becoming an increasingly important part of vehicle safety and ownership. The same technology that allows us to unlock a car from our phones or check its location from miles away also depends on complex digital systems that must be properly protected.

The good news is that drivers don't need to be technology experts to reduce some of these risks. Keeping software updated, securing accounts, and paying attention to privacy settings are simple steps that can help protect both your vehicle and the personal information connected to it.