Surveillance footage shows the two getting inside of the family's white Range Rover after the boy got a hold of the keys around 10 a.m., the NYPD said.
About an hour later, authorities used E-ZPass information and license plate readers to track the car on the Verrazano Bridge, CBS reports.
At one point, New Jersey State Police troopers spotted the car -- but the boy sped off, the outlet said.
They were tracked down at 2:30 after nearly five hours, when police got a notification the boy's dad's credit card had been used to buy cookies at a rest stop, authorities said.
According to CBS, the multi-state trip could have been part of a social media challenge.
An email sent to New Jersey State Police Monday evening was not immediately returned.
Click here to follow Daily Voice Lyndhurst and receive free news updates.