Before going car shopping recently, Reyna Garcia did her homework.

She was interested in buying a used Kia Forte from a local dealership near her home in Aurora, Co., but she'd heard about a wave of thefts across the country involving certain Kia and Hyundai vehicles. She asked the salesperson whether the 2020 model she wanted was affected.

"His response was something like, 'Well, this car has a push-button start, so you should be fine,'" Garcia said in an interview with NPR.

The deal went through, and Garcia and her teenage daughter began driving the car.

Only weeks later did they discover the problem: Garcia had added the Forte to her Allstate insurance policy via the company's mobile app while she was at the dealership, but when she followed up later, she learned that the company was refusing to cover the Forte because of the high rate of thefts.

Garcia and an insurance broker tried a dozen more companies, but they all refused coverage. She said she explained her situation to the dealership and tried to sell the Forte back to them, but their offer would have left her with a $7,000 loss.

"I feel super vulnerable. I feel taken advantage of by a dealer. I feel like this is their industry, and they should be knowledgeable about this. And I'm also very frustrated with the insurance industry," Garcia said. "All of those things came colliding, and I think the consumer is definitely stuck in the middle."

Officials say more than eight million Hyundais and Kias from model years 2011 to 2022 can be hotwired with a USB cable and lack an engine immobilizer, a common anti-theft feature that prevents the engine from starting unless the vehicle's key is nearby. They increasingly have become targets for thieves.

Both manufacturers are offering affected customers free software upgrades they say will fix the problem, but cars affected by the vulnerability are still on the market, despite the fact that a growing list of major insurance companies say they won't cover them for the time being. Most states require drivers to have automobile insurance to be on the road.

Consumer advocates say that the blame lies with several players — the carmakers that omitted anti-theft features on certain models, the dealers that continue to sell the affected vehicles, the insurers that are denying coverage — but that it's the drivers who are getting stranded.

"People can't just go and buy a new car necessarily," Douglas Heller, director of insurance at the Consumer Federation of America, told NPR. "There are a lot of people who can only afford a used car, and this might be an affordable vehicle that's otherwise probably pretty typical when it comes to risk."

A hack that spread on social media

For the past couple of years, videos have cropped up on TikTok of people demonstrating how to steal certain Hyundais and Kias with a keyed ignition. Thieves can remove the steering wheel column cover and start the car with a USB cable or something similarly shaped.

Because these models also don't have engine immobilizers, a thief is able to start the car and drive away without a key. About a quarter of Hyundai's and Kia's 2015 vehicle series had standard immobilizers, compared with 96% of all other makes, according to the Highway Loss Data Institute.

Since the social media trend gained popularity, thefts of these vehicles have surged. In Minneapolis last year, thefts of Kias and Hyundais ballooned by 836% over the previous year. Federal regulators said earlier this year that eight people had died in 14 crashes related to the TikTok challenge.

In April, a group of state attorneys general called for a national recall of the affected vehicles, saying the thefts are creating a "safety crisis" on U.S. roads, but so far the National Highway Traffic Safety Administration hasn't initiated one.

Insurance companies, however, have taken action. Several announced wouldn't take new customers with vehicles that have these vulnerabilities.

Allstate, Progressive and State Farm all confirmed to NPR that they aren't granting new insurance policies in some states for certain Hyundai and Kia vehicles due to the high risk posed by the thefts. Existing customers will keep their coverage.

"Insurers are in the business of taking on new customers, so this is a highly unusual circumstance," said Michael Barry, chief communications officer for the Insurance Information Institute, an industry group.

"But the theft rates of certain Hyundai and Kia vehicles are so high that a number of name-brand insurers — to protect their own bottom line as well as those of their other policyholders — have decided to temporarily hold off on taking on new policyholders," he told NPR.

The companies didn't say which specific models they wouldn't cover, but WWL-TV in New Orleans reported that State Farm was pausing coverage of some popular vehicles, including Hyundai's Elantra and Tucson and Kia's Optima and Sportage.

Hyundai says that the software fix for its vehicles is currently available at all of its dealerships nationwide, while Kia says it is continuing to roll out its upgrade. It's unclear how many customers have received the software patches to date.

In mid-April Hyundai also announced it had partnered with AAA-affiliated insurers on a program to offer insurance plans to people who had bought cars affected by the thefts. Kia spokesperson James Bell told NPR the company was also working with insurers on a solution.

"Kia America regrets the decision by certain insurers and its impact on owners and lessees of select Kia vehicles, which we anticipate will be temporary," he said in an emailed statement. "We are in contact with major insurance carriers so they are aware of the actions we have taken and we are actively working with them to ensure our customers have access to quality and comprehensive coverage."

Gaps still leave some some car buyers behind

Auto insurance is regulated by state governments, and some have taken note of insurers pausing coverage of certain Hyundai and Kia vehicles.

The Maryland Insurance Administration issued a bulletin in February reminding companies that they have to insure vehicles according to the rates they've filed with the state, and that refusing to do so could be a violation of state law.

Reyna Garcia said that when she bought the Forte in early April, the dealership only confirmed that she had an auto insurance policy with Allstate, but didn't confirm that Allstate had accepted the Forte onto the policy before they let her leave with the car.

When contacted by NPR, Allstate said through a spokesperson that it was reaching out to Garcia "to apologize for the breakdown in service." The company also said that liability coverage is available for affected vehicles in Colorado but comprehensive and collision coverage is not.

The dealership where Garcia bought the car did not reply to a message left by NPR.

Experts say potential buyers should check with their insurance company before buying a used Hyundai or Kia to make sure that they'll be able to insure their purchase when they drive off the lot.

CarMax, the nation's largest used car seller, said in a statement that it requires that customers arrange for insurance when they purchase a vehicle.

"We are aware that certain insurance companies may not be currently offering coverage in select markets for some Kia and Hyundai models," the company said in an emailed statement to NPR. "If a customer has questions about eligibility or coverage, we encourage them to contact their insurance company."

Last week, Garcia finally got auto insurance on the Forte through Liberty Mutual.

To get the best rate, she had to move over her family's other two auto insurance policies and her homeowner's insurance policy to Liberty Mutual, too. She's paying $150 more per month than she used to.

The single mom, who shares an auto insurance plan with two of her daughters, is still worried that the agreement could somehow fall through and that she'd be on the hook for the rest of the loan she took out to purchase the Forte.

Garcia, who works for a health plan, says she knows how the insurance industry works but had never heard of companies refusing to cover specific vehicle models.

"I'm an intelligent person, and I feel very stuck. And the financial loss could be huge. I'm sitting here trying to figure out how I could come up with $19,000 to pay for a car that we can't drive," she said. "This, again, just seems like a complete debacle — that these companies and these industries are not working together to protect the consumer."