Alarm Systems and Intrusion Detection

Last modified: Jul 30, 2026

A vehicle alarm detects selected signs of intrusion or interference and generates a warning. It can deter a thief and notify an owner, but it does not replace locks, an immobilizer, a camera or a recovery plan.

The detection layers

A basic perimeter alarm monitors the open-or-closed state of doors, front and rear cargo openings and, on some vehicles, the charge-port door. The system arms after the vehicle is locked and triggers when a monitored opening changes state without valid disarming.

Additional sensors can cover other attack paths:

  • interior movement sensing uses ultrasonic, radar or another cabin sensor to detect movement after the vehicle is locked;
  • tilt sensing detects a change in vehicle angle associated with towing, jacking or wheel theft;
  • glass-break sensing looks for an acoustic or vibration signature;
  • impact or acceleration sensing can react to movement or a collision; and
  • tamper monitoring can watch selected power, siren or communication circuits.

UN Regulation No. 163 defines a vehicle alarm system as one designed to indicate intrusion into or interference with a vehicle. Its approval requirements provide a technical baseline in participating markets; they do not mean every optional sensor is fitted to every approved car. UNECE: UN Regulation No. 163 on vehicle alarm systems

What happens after a trigger

An alarm event follows a chain:

  1. A sensor observes a condition.
  2. Control logic decides whether the condition is valid for the current armed state.
  3. The vehicle activates an audible or visible warning.
  4. A connected system may send an app notification or record an event.
  5. A camera system may preserve video if it is enabled, supported and has working storage.

Each link can fail independently. A siren may sound where the owner cannot hear it. A notification may be delayed by poor mobile coverage. A camera may detect motion without classifying it as an alarm, or an alarm may trigger without usable video.

Tesla's owner manual demonstrates this separation: Sentry Mode can use cameras and sensors, sound the security alarm, alert the app and save footage when the required storage is present. Tesla also warns that not every impact will be detected and no security system prevents every attack. Tesla Model S Owner's Manual: Sentry Mode

Arming, disarming and occupancy

The vehicle should arm only when the relevant openings are closed and an authorized user has locked it. Unlocking with an approved key normally disarms it; opening with a mechanical emergency key may require a separate electronic authorization to prevent a trigger.

Interior sensing needs an explicit override. A pet, sleeping occupant, moving object, ferry, car train, workshop lift or towing operation can create legitimate movement. Some vehicles offer a reduced-guard mode that keeps the perimeter alarm active while disabling cabin or tilt sensing.

The override should be temporary and visible. Permanently disabling a noisy sensor hides the fault and removes protection. Repeated false alarms need diagnosis: an incorrectly closed opening, low-voltage problem, damaged sensor, unsuitable sensitivity or actual interference can produce similar symptoms.

Alarm, immobilizer and drive PIN

An alarm reports selected interference. An immobilizer denies normal propulsion without an authorized credential. A drive PIN adds another authorization step after a key is accepted.

A vehicle can therefore be entered without being drivable, driven with no alarm if a valid credential is abused, or towed despite both systems. Strong theft protection combines controls with different failure modes. See Theft prevention and recovery for the complete layer model.

Connected alerts and camera recording

App notifications reduce dependence on being close enough to hear a siren. Useful alerts identify the vehicle, event type and time without exposing more account or location data than necessary. High-impact actions—disarming, adding a driver or downloading video—should require stronger authorization than reading a notification.

Camera-linked systems can add evidence. BMW's current ConnectedDrive terms, for example, describe an Anti-Theft Recorder that depends on the alarm system and Drive Recorder equipment, stores video and vehicle data in the car, and can make recordings available through the app where legally permitted. Availability and behavior vary by vehicle and country. BMW ConnectedDrive terms for camera and anti-theft services

Parked-camera operation is covered separately in Parked-camera surveillance.

Setup and testing

Owners should use the manual's test procedure rather than striking, rocking or otherwise risking damage to the car. A useful check includes:

  • every protected opening and the mechanical emergency-entry behavior;
  • interior and tilt sensor overrides;
  • siren and hazard-light operation;
  • app notification permissions and account recipients;
  • camera storage health, if recording is linked;
  • the low-voltage battery's condition; and
  • the actions required after an accidental trigger.

Do not leave a person or animal in a locked vehicle merely to test a sensor. Climate modes and occupancy-protection features may change alarm behavior, and cabin safety takes priority.

Responding to an alert

Treat an alert as unverified until the situation is assessed. Check the event type, time, location and available camera view from a safe place. Contact police if a crime may be in progress; do not approach a suspected intruder.

Preserve relevant clips and notifications before storage overwrites them. After forced entry, avoid disturbing possible evidence, check whether credentials or personal data were exposed, and arrange inspection of locks, glass, sensors and any accessible diagnostic area.

Sources

More information