Design ownership transfer so that moving control of a connected device needs proof from the current owner, alerts them, and revokes the old account's access. In the Kia dealer portal case, researchers reported demoting the registered owner and adding themselves in four API calls, and the owner received no notification. That is the failure this checklist is built to prevent.
Why transfer is risky
A connected car, robot or drone has an owner record in the cloud. Whoever the cloud believes is the owner can send commands, such as unlock, start, locate or move. Changing that record changes who controls a physical machine.
In the case described by researchers, a dealer account could look up a vehicle by VIN, then demote the registered owner and become the primary owner. The write-up says no notification went to the owner, and that it worked whether or not the vehicle had an active subscription.
The checklist
Authorizing a transfer
- Require the current owner to approve. A role that can transfer without that approval needs a very narrow purpose and strong controls.
- Use a second factor or a physical proof step, such as a code shown on the device or a button on it.
- Separate "dealer", "installer", "support" and "owner" roles, and do not let anyone create a privileged role through a public endpoint.
Notifying
- Tell the old owner by every channel on file, immediately, with a way to dispute.
- Keep a visible history in the app of ownership and role changes.
Revoking
- Revoke old tokens, shared keys, paired phones and API keys when ownership changes.
- Remove the previous owner's saved locations, camera clips and trips, or hand them a copy and delete them.
- Reset local pairings on the device, so old phones cannot reconnect.
Resale and repair
- Provide a clear reset or "release from account" flow for a seller, and make it work offline.
- Make dealer or service transfers time limited, logged and tied to a work order.
Detecting abuse
- Alert on unusual patterns, such as many ownership changes from one account.
- Log who asked for a change, from where, and on what evidence.
Identifiers are not secrets
A VIN, a serial number or a license plate is not a secret. In the reported case, a third-party service converted a plate into a VIN. Do not treat any identifier that appears on the outside of a device as proof of authority.
Test it
Ask your team to attempt, with a test account, to take over a test device as a dealer, as a support agent and as a former owner. Record what each role could do and how fast the real owner would find out. Many teams find the weakest path is a role built for convenience.
Safeguard's scanning can catch some web application flaws, and a free scan is available at https://gold.safeguard.sh/scan. The role and transfer logic itself still needs a design review by a person.
Quick check
Is a VIN a good proof of ownership?
No. A VIN is visible on the vehicle and can be derived from other data, as the reported Kia case shows with a license plate lookup.
Sources
Last reviewed: 19 October 2026.
