The Empty Bay: A First-Day Protocol for a Stolen Van

A stolen van rarely disappears quietly from the business. It takes with it a set of keys, a load, a fuel card, possibly a mobile device and a trail of telematics data that will matter to the insurer, the police and, in some cases, the leasing company. The first 24 hours are not simply a wait for recovery. They are the period in which the quality of the fleet's response is set.

For an SME fleet without a dedicated security function, that response needs to be written down before it is needed. Prevention has its place, but this protocol begins at the point where prevention has failed. It assumes a van has gone and concentrates on containment, notification, evidence and communication.

Name an incident lead before the event

The first practical measure is a named incident lead, usually the fleet manager or operations manager, with a deputy. That person should be the single point of contact for the police, insurer, tracking provider and any leasing company. Split responsibility is a common source of delay: one person rings the insurer while another rings the tracker provider, and neither records the crime reference against the same case.

Keep an incident pack ready, accessible away from the office if necessary. It should include the vehicle registration, VIN, livery photographs, mileage at last use, insurance schedule, leasing agreement where applicable, key inventory, fuel card numbers, telematics account details and tracker provider contact. In 2026, it is also sensible to record which members of staff hold app access to tracking or fuel-card systems. A stolen van can quickly become an access-control problem as well as a transport problem.

The first hour: verify, report and secure

Establish the basic facts without speculation: which van, last known location, time last seen, driver, cargo and whether anyone is at risk. If a person is in immediate danger, call 999. Otherwise, report the theft to the police through 101 or the relevant online reporting route and obtain a crime reference number. Do not attempt to pursue or confront the vehicle if a tracker shows a location; pass information to the police and the tracking provider.

Secure the keys. Account for every fob and key for the stolen vehicle, including spare sets held in the office, workshop or by a relief driver. If a key was taken with the van, say so clearly to the insurer and tracker provider. If a spare remains on site, move it to a secure location and record who has access. Do not attempt to reprogramme or disable vehicle systems unless the manufacturer or tracking provider directs it.

Notify the insurer within the timeframe required by the policy. Have the crime reference, registration, VIN and key status to hand. If the van is leased or financed, notify the leasing company or funder as well; they have an interest in the asset and may have their own reporting requirements. Then contact the tracking provider, supply the crime reference and ask for the live locate process to be activated in line with police liaison arrangements.

Preserve evidence before tidying up

A stolen-vehicle claim is stronger when the fleet can show a clean sequence of events. Preserve telematics data rather than relying on a dashboard view that may roll over. Export journey history, driver ID data and any alerts around the time of the theft. Preserve CCTV from the yard, gate or workshop, and note the time window rather than waiting for a later request. Keep the original files and record who copied them and when.

Do not wipe or reassign the vehicle's telematics account, even if a replacement van is being arranged. Do not clear fuel-card transactions or delete messages relating to the vehicle's movement. If the van carried documents, devices or personal data, treat that as a separate incident. Suspend fuel cards, mobile devices and any access fobs or account credentials connected to the vehicle or its usual driver. Where personal data may have been in the vehicle, involve the business's data protection lead at once.

Close the access routes

List every system the van touched: fuel cards, depot gates, barrier fobs, parking accounts, toll accounts, charging accounts and any shared tracking app. Suspend or reissue credentials where there is a realistic risk. Check whether the stolen vehicle's registration is attached to any automatic gate or ANPR-based access list and remove it. If the van was signwritten, record the livery details for the police and insurer, but avoid publishing registration numbers or live tracker information on social media unless the police explicitly advise it.

Speak to the driver as a witness

The driver's first account matters, but the conversation should be handled carefully. Treat the driver as a witness unless there is clear reason to do otherwise. Ask for a factual account: last parked location, time, load, keys, passengers and any unusual activity. Record it with a timestamp and the driver's signature where appropriate. Give the driver a short communications line: direct all media and social-media enquiries to the incident lead, and do not speculate about the circumstances. Consider welfare support, particularly if the theft involved threats or confrontation.

Brief the rest of the driving team only on what they need to know. If a vehicle is sighted, they should report it to the incident lead or police, not follow it. A short written note is better than a series of verbal briefings that later contradict one another.

Hours two to six: build the incident file

Create a single incident log with times, names and reference numbers. It should capture the police crime reference, insurer claim reference, tracker case number, key inventory, cargo list, CCTV preservation step, telematics export, fuel-card suspension and any access changes. If the load was insured separately, notify the cargo insurer. If the van was hired in or loaned out, notify the owning business.

At the same time, review the remaining fleet. If the theft suggests a key relay or keyless-entry attack, move high-risk vehicles away from external walls and consider additional physical barriers overnight. Check whether any other keys are unaccounted for. This is not a full security review; it is a containment step for the first night.

The first evening: recovery is not the only outcome

The insurer may authorise a temporary replacement or hire vehicle. Decide who will update customers and which deliveries or service calls need to be moved. Keep customer communication factual and avoid promising a recovery timeline. If the vehicle is later found, do not collect it until the police and insurer confirm it is released and any forensic examination is complete. A recovered van may still need damage assessment, lock replacement and a data review before it returns to service.

Next morning: the 24-hour review

Meet briefly with the incident lead, a senior manager and whoever handles insurance. Confirm that the police report, insurer notification and tracker case are all live. Check that evidence has been preserved and that access credentials have been suspended. Identify any gaps in the incident pack and correct them the same day.

A simple checklist is enough:

• Crime reference obtained and logged.
• Insurer and, where relevant, leasing company notified.
• Tracker provider activated and police liaison confirmed.
• All keys and fobs accounted for.
• Fuel cards, devices and access credentials suspended.
• Telematics, CCTV and driver account preserved.
• Cargo and personal-data implications assessed.
• Driver and remaining team briefed.
• Replacement or hire decision recorded.

The aim of the first 24 hours is not to solve the theft. It is to create a defensible record, close the obvious access routes and give the police and insurer the information they need quickly. A fleet that can do that calmly is better placed whether the van is recovered, replaced or written off.