In Brussels, there has been a noticeable increase in thefts of Poppy shared and rental cars. Exact figures are not available, partly because some cars are recovered before they are reported stolen, and because attempts are often considered vandalism.
What is striking, however, is that the thieves are often minors without a driver’s licence. They are said to be exploiting a weakness in Poppy’s security system, which allows them to start the cars without a key.
No exact figures
According to the newspapers La Capitale and Bruzz, between January and October, the Brussels Capital Ixelles police zone recorded 18 thefts of vehicles belonging to car-sharing and rental company Poppy, a subsidiary of the Brussels holding company D’Ieteren.
In the Brussels North police zone, there were 9 reports of theft or attempted theft of Poppy cars, and 10 suspects were arrested, including 2 minors. In addition, 27 reports were filed for thefts that occurred in other Brussels municipalities and at Charleroi Airport.
In the Marlow zone (Uccle, Watermael-Boitsfort, and Auderghem), there were already three thefts in the first week of November alone, involving suspects aged 15 to 18.
Rise in keyless-car hacking
The common thread in all these thefts is that the suspects allegedly exploited a weakness in Poppy’s security system, allowing them to start the cars without a key. The police say a specific method is circulating among youths, but they won’t disclose details for safety reasons.
According to the police, the suspects are also often young people, sometimes even minors, who drive without a licence. In that sense, the thefts are more akin to joyriding.
When you rent a car from Poppy, you receive a link via the app to unlock and start a rental car. However, some models still have a physical key. This is in a holder in the glove compartment.
But if there’s a software or hardware flaw — or if someone discovers a bypass — it can spread quickly on social media or through peer groups. Once that method is known, anyone with minimal knowledge could unlock and start a vehicle without official authorization.
For that matter, European police and Europol have also reported a rise in keyless-car hacking, using signal boosters, cloned digital keys, or software vulnerabilities, just as other European cities have seen similar surges in thefts of keyless, free-floating cars.
Other users pay for damage
Another factor is that Poppy’s free-floating model often makes their cars easy targets for theft. Poppy cars are parked anywhere within large urban zones rather than in secure stations.
That means some cars sit unattended for long periods in quiet streets or industrial zones, making them easy to spot and break into. Indeed, Poppy recently changed its zone policy to stop leaving cars in underused residential and industrial areas.
In a response, Poppy points out that the thefts do not pose a threat to the company’s survival, partly because they are part of the business model. However, the service could be up to 10% cheaper, precisely because the costs and damage caused by theft are covered by paying users.
In March, car-sharing company Miles announced its departure from Belgium. The German company cited “vandalism, abuse, and theft, especially in Brussels,” as the main reason for its exit.
