How to Find a Hidden GPS Tracker in Your Vehicle – Comprehensive Manual
Dear Customer,
we are responding to your suspicion regarding possible unauthorized tracking of your vehicle. Since we currently do not perform physical technical inspections of vehicles due to capacity reasons, we have prepared a comprehensive manual and professional guidance on how to proceed independently in this situation.
To successfully detect a tracking device, we recommend purchasing a radio frequency (RF) detector / signal scanner. Below you will find a detailed explanation of how these systems work and precise instructions for their use.
📖 MANUAL: How to find a hidden tracker in your vehicle
To successfully find a tracking device, you must first understand what type of threat you are dealing with. Attackers today use two different technologies that require a completely different approach to searching.
📊 1. Threat analysis: Principle of tracker operation
A. Professional GPS trackers (GSM / 3G / 4G / 5G)
Ako fungujú: These devices only passively receive the GPS satellite signal to determine their position. They then send this position via the mobile network (via SIM card) to the attacker's server or application.
Správanie signálu: The device does not transmit continuously. To save battery, it mostly waits passively. The transmitter activates and sends a short, strong radio frequency (RF) pulse only when the vehicle is moving, or at regular time intervals (e.g. every 5 minutes, once an hour).
Ako ich odhaliť: Exclusively using a radio frequency (RF) scanner at the moment when this device actively communicates with the operator (sends data).
Professional note: For these devices, it is important to monitor GSM frequency bands (850/900/1800/1900 MHz) and LTE (800/1800/2600 MHz). Modern trackers also use NB-IoT or LTE-M, which have even lower consumption and their signal is even harder to detect. The RF scanner should have sufficient sensitivity (e.g. -90 dBm to -100 dBm) and the ability to distinguish short data bursts from background noise.
B. Commercial Bluetooth Tags (Apple AirTag, Samsung SmartTag, etc.)
Ako fungujú: They have no GPS chip or SIM card. They work on the principle of Bluetooth (2.4 GHz) with low power. They continuously broadcast an encrypted code around them. If anyone with a compatible smartphone passes by your car, their phone captures this code and anonymously sends the tag's location to the internet network.
Správanie signálu: They transmit continuously, but their signal is very weak (low range approx. 10–20 meters). A common RF detector will only detect them from immediate proximity (a few centimeters) or not at all due to low power.
Ako ich odhaliť: Much more effectively than with a scanner, you can detect them directly using a smartphone and specialized applications that can trigger their beeping sound.
Professional note: Bluetooth tags use BLE (Bluetooth Low Energy) with a frequency of 2.402–2.480 GHz and transmit power typically -20 dBm to +10 dBm. Their MAC address is often randomized, so they cannot be identified by manufacturer. RSSI (Received Signal Strength Indicator) is used for precise localization – the closer you are, the higher the value (in dBm). Ideally, use a spectrum analyzer or BLE sniffer that can also capture channel hopping.
🛠️ 2. Practical search procedure (Step by step)
Before starting the inspection, park the car in a remote location (e.g. empty parking lot outside the city, forest road). It is absolutely essential to eliminate "electrosmog" from surrounding Wi-Fi networks, mobile operator transmitters and other passing cars.
Professional note: Ideally, use a Faraday cage or shielded chamber if you want to completely eliminate external interference. In practice, however, this is not possible, so it is recommended to at least move away from civilization and turn off all your own electronic devices.
PHASE 1: Detection of Bluetooth tags (AirTag / SmartTag)
This phase does not require an RF scanner, only your smartphone.
- Turn off Bluetooth and Wi-Fi on all your devices (except the phone you will use for scanning).
- If you have an iPhone: The iOS system will notify you about a foreign AirTag after a certain period of joint movement with the notification "Device detected with you". In the Find My app, you can remotely trigger a sound on the detected tag.
- If you have Android: Go to Settings -> Safety and emergency -> Unknown tracker alerts (available for Android 14 and newer) and start manual scanning of the surroundings.
- For AirTags, download the official Apple app called Tracker Detect. If the app finds a foreign AirTag that is nearby for more than 10 minutes, it will let you play a sound on it.
- Universal signal search: Download the Wunderfind or BLE Scanner app. These applications show Bluetooth signal strength (RSSI) in percentages and in real time. Walk around the car and inside, and watch whether the percentage signal strength increases to 90–100% at some place. If so, the tag is hidden exactly there.
Professional note: When scanning BLE, it is also advisable to use applications such as nRF Connect or LightBlue, which also display UUID, major/minor values and TX power. If you want to go even deeper, use a BLE sniffer (e.g. Nordic Semiconductor nRF52840 Dongle) and capture advertising packets. These will tell you whether it is an AirTag, SmartTag or another device.
PHASE 2: Detection of professional GPS tracker (Using RF scanner)
For this phase you will need a radio frequency scanner.
- Complete isolation: In the car, turn off the engine, onboard computer, radio and switch all mobile phones strictly to Airplane Mode (including turning off Wi-Fi and Bluetooth in the menu itself). If you left your mobile on, the scanner would constantly react to it and targeting would be impossible.
- Scanner calibration: Turn on the RF detector and set its sensitivity just below the level where it starts beeping or showing activity due to natural background noise.
- Stationary test (Time trackers): Some trackers send their position at static intervals (e.g. every 10, 30 or 60 minutes). Sit in a quiet vehicle for approximately 15 to 20 minutes and watch the scanner. If the device suddenly beeps intensively for 2–3 seconds or shows a sudden peak (high activity on GSM/LTE frequencies), the tracker has just sent a data packet.
- Motion test (Trackers with motion G-sensor): Modern professional trackers save battery and sleep while the car is stationary. They wake up only with movement. Arrange for an assistant to slowly drive the car on a deserted road. Sit in the passenger seat and slowly move the scanner very close (a few centimeters) around all suspicious places in the interior. A tracker in motion sends data much more frequently (e.g. every 30 seconds), which the scanner will immediately and repeatedly capture.
- Exterior test: Stop at a safe, deserted place, leave the engine running (so the tracker is active) and move the scanner from the outside closely around the bumpers, wheels and chassis.
Professional note: For RF scanning, it is important to have a scanner with sufficient dynamic range and demodulation capability. For example, for GSM it is advisable to use a scanner with a frequency range of at least 800 MHz – 2.6 GHz. If you also want to capture 5G NR (New Radio), you need a scanner with a range up to 3.5 GHz or 28 GHz (mmWave). In practice, however, 5G trackers are still rarely used because they have higher consumption.
🔍 3. Topographic map of hiding places: Where exactly to search?
Trackers are divided into magnetic (they have their own battery and attach to metal) and powered directly from the car (they are secretly connected to the vehicle's wiring). Focus on these three key zones:
1. Vehicle interior (Most common place for Bluetooth tags and cable trackers)
- Diagnostic socket (OBD-II): Usually located under the steering wheel or near the fuse box. There are trackers in the shape of a small black cube that look exactly like part of the car and simply snap into the socket (installation takes 3 seconds).
- Under the dashboard and fuse box: Space above the pedals, under the steering wheel, behind the radio and behind the passenger glove compartment. Look for any non-original wiring, fresh insulating tape or hidden boxes connected to original cable harnesses.
- Seats and upholstery: Pockets on the back of seats, space under seats (in rails), space under headrests and upholstery gaps. Since Bluetooth tags are small and have no magnet, attackers often just freely throw them under floor mats or into side door storage compartments.
Professional note: When inspecting the interior, it is advisable to use an endoscopic camera or borescope to inspect hard-to-reach places. We also recommend checking the space behind the center panel and under the roof lining – some trackers are also installed there.
2. Vehicle exterior (Look for magnetic trackers)
- Chassis and sills: The most common place for professional trackers with their own large battery (which lasts for months). Check the metal chassis frame, especially in corners, folds and behind plastic covers.
- Under the bumpers: Both front and rear bumpers offer plenty of hollow space and plastic material, unlike metal, does not block the propagation of GPS and GSM signals.
- Wheel arches: Space behind the plastic wheel well directly above the wheels.
Professional note: Magnetic trackers often have a strong neodymium magnet that can also be detected using a compass or magnetometer. If in doubt, use a magnetometer with a resolution of at least 0.1 mT.
3. Trunk and engine compartment
- Trunk: Space under the spare wheel, in side recesses behind the carpet (where the first aid kit, tools or internal fuse box are usually located).
- Engine compartment: Professional trackers are usually connected directly to the car battery or to the fuse box in the engine. Look for any non-standard cables leading from the positive and negative battery terminals.
Professional note: When inspecting the engine compartment, be careful of heat and moving parts. Ideally, use insulated tools and a scanner with overheating protection.
📋 4. Summary comparison and search indications
| Tracker type | What it transmits | Where does it most often hide? | How to detect it fastest? |
|---|---|---|---|
| Commercial Tag (AirTag/SmartTag) | Bluetooth (low range) | Interior, seat pockets, trunk, under floor mats. | Mobile apps (Tracker Detect, Wunderfind) + triggering the beep. |
| Professional Tracker (battery-powered) | GSM/LTE (short pulses) | Chassis (magnet), plastic bumpers, wheel arches. | RF detector while driving + visual inspection with a mirror. |
| Professional Tracker (hardwired) | GSM/LTE (short pulses) | Behind the dashboard, OBD-II socket, fuse box. | RF detector focused on cable harnesses under the steering wheel. |
Professional note: If you want to go even further, you can also use the TSCM (Technical Surveillance Countermeasures) approach – a combination of RF scanning, physical inspection, thermal imaging (trackers can heat up) and power analysis (measuring current draw). In some cases, it is also worth using a spectrum analyzer with waterfall display, which can detect even very short and irregular pulses.
📞 Conclusion and recommendation
If you are interested, we can also provide you with a list of recommended devices and applications, or recommend specific models of RF scanners and BLE sniffers. Do not hesitate to contact us.