How 'Buy Here Pay Here' GPS Tracking Devices Work

GPS tracking devices are a common sight in cars sold by “Buy Here Pay Here” dealers, and some are even showing up at franchise dealers. A lot of speculation exists about how the devices work and what they can actually track, but most of it comes from third-party reports.

Working as a tracking device installer for a brief period of time gave me an inside view of that market, allowing me to share what actually goes on behind the scenes.

Tracking devices are most often installed by dealers who sell cars to buyers with a low credit score that does not qualify them for a traditional loan. The money for these loans usually comes from the dealers themselves or from subprime financing institutions. Due to the risk factor involved, many of these loans come with a stipulation of having a tracking device installed.

These devices are generally split into two categories: tracking-only devices which can only passively track the car, and starter-interrupt devices (SIDs) which can interrupt the starter and prevent the vehicle from starting. Most vendors sell both or offer the interrupt service as an add-on. These devices generally start under $100, going up slightly as options are added. Along with the purchase price, dealers usually pay a small monthly fee for the service, based either on a flat rate or on the number of lookups performed by the dealer or lender.

Installation of these devices is fairly simple and is usually performed by authorized installers, stereo shops, or dealership employees. The device are composed of a main control unit that requires power and ground and an external GPS antenna routed to provide the best possible reception. The devices are usually hidden away under the dash, preventing owners from finding and disabling them. Most loan agreements include a provision intended to prevent tampering.

The intrusive installation happens when a starter-interrupt device is installed, as it requires cutting the engine starter wire. In those scenarios, the starter is routed through the control box of the tracker, requiring the tracker to complete the circuit for the starter in order to turn the engine on. Dealers and lenders that use the boxes have the capability to disable a starter — meaning once the signal is sent, the car will not be able to restart after it is shut down. I haven’t seen any devices set up in a manner that could shut down a car while it was driving, though I have seen poor crimping jobs where the wires came apart and the car was not able to start (even though it wasn’t disabled).

Once a starter is disabled, most devices offer some sort of signal — such as a beep — to let the customer know an action has taken place. Some devices are fully remote and can be enabled via an online dashboard. Others have a keypad that requires the customer to enter a code supplied by the dealer or lender once they have paid off their outstanding balance.

Usually, a plethora of software analyzes the tracking data. In the most basic packages, dealers can ping a car at any time to see where it is located, and can set a geofence alerting them if a car leaves a certain geographical area. Many packages also offer more advanced features such as tracking the vehicle’s most commonly visited locations. These services are advertised as allowing easier repossession even if a device is disabled, as the driver is likely to visit those locations again.

Most of the dealers I worked with had these devices on a “set it and forget it” strategy — they would install them and only check them when a customer fell behind on their payments. Most of them also offered a free removal service once the loan was satisfied, as they did not want to be tracking paid-off cars and could reuse the devices in many cases. The trouble usually comes from dealers that abuse these devices and disable them prior to an agreed-upon date, either to try and get customers to pay faster, or to try and extract more money in order to remove devices once a car is paid off.

Following some high-profile leaks, concerns have arisen over the devices’ data storage levels. One leak resulted in over half a million password being leaked from the SVR Tracking database. Since most of these companies interface with car dealers and store data on car buyers, you can see how data security might not be high on the list. A few states have started regulating the devices. However, because they are so new, laws differ widely from state and very few standards exist for them.

As these devices are becoming cheaper and more widely used, hopefully some consumer protections will follow.