Keyless Car Theft: How Relay Attacks Work and How to Prevent Them
The Short Answer
A relay attack is a way of stealing a car with keyless entry and keyless start without ever touching the owner's key fob. Thieves use radio equipment to extend the fob's signal, so the car behaves as if the key is right beside it, even when the fob is inside the house. The car then unlocks, and on many vehicles it can also be started and driven away.
The core defense is to stop the fob's signal from being picked up when you are not using the car. You can do this by storing the fob in a signal-blocking pouch or box, or by turning off the fob's keyless function if your vehicle allows it. Physical and secondary barriers add further protection: a steering wheel lock, an OBD port lock, an aftermarket immobilizer or a tracker. How much risk you face depends on your vehicle's keyless system. Some newer fobs are designed to resist relaying, while older passive keyless systems generally are not.
Key Terms
Smart key or key fob: the electronic key that communicates with the car by radio. Passive keyless entry and start: a system that unlocks the doors and allows push-button starting whenever the fob is detected nearby, without the owner pressing a button. Immobilizer: an electronic system that prevents the engine from running unless a recognized key is present. Relay attack: extending the communication between the car and a distant fob so the car believes the key is close by. OBD port: the onboard diagnostics connector, usually under the dashboard, used by technicians to read and program vehicle electronics.
How a Relay Attack Works
Passive keyless systems rely on short-range radio. When someone touches a door handle or presses the start button, the car sends out a low-power signal. If the fob is close enough to hear it, the fob replies with a coded response, and the car checks that response before unlocking or allowing the engine to start. The security assumption is that only a fob physically near the car can reply.
A relay attack breaks that assumption. It generally follows this sequence:
1) Thieves work in pairs. One stands near the home, office or wherever the fob is likely to be kept, often close to a front door or window. 2) That person's device picks up the fob's signal and passes it to a second device held by an accomplice standing next to the car. 3) The car's request is passed back to the fob, and the fob's reply is passed back to the car. 4) The car receives a valid reply, so it unlocks. Because the fob seems present, the push-button start may also work. 5) Once the car is running, it typically keeps running after the relay link is broken, allowing it to be driven away.
The coded response is not cracked or copied in this attack. The real fob does all the authentication; the thieves just carry its conversation over a longer distance. That is why encryption alone does not prevent relay theft, and why blocking or disabling the fob's signal is effective.
What This Means in Practice
A fob kept near an entrance or exterior wall is more exposed than one stored deeper inside the home. The attack can be quick and quiet, with no broken glass or forced lock, so there may be no visible sign of entry. A locked car is not protected if the fob can still be reached by radio. The car's own alarm may not trigger, because the car treats the event as a normal key-present unlock.
Limits of the Attack and of Newer Systems
Relay attacks only work while the fob is powered and responding. A fob inside a working signal-blocking enclosure, a fob whose keyless function has been switched off, or a fob that has gone into a sleep mode cannot be relayed. Some manufacturers fit fobs with motion sensors that make the fob stop responding after it has been still for a while. Others use ultra-wideband (UWB) radio, which can measure the distance between fob and car more precisely and is intended to make relaying much harder. Which vehicles and model years include these features varies by manufacturer and market, so check your owner's manual or ask a dealer rather than assuming your fob has them.
Other Ways Thieves Exploit Keyless Systems
Relay theft is not the only fob-related method. Two others are worth knowing about because they need different defenses:
Key programming through the OBD port: after gaining entry, a thief connects to the diagnostics port and attempts to register a new blank key to the car. An OBD port lock or relocation, and an aftermarket immobilizer that requires a separate code or tag, can address this. CAN injection: thieves reach the vehicle's internal data network, for example through wiring behind a headlight or bumper, and send messages that imitate a valid key being present. Fob pouches do not prevent this, because the fob is not involved. Physical locks, aftermarket immobilizers and manufacturer software updates are the relevant defenses.
Which methods affect which vehicles is not covered by the information available for this guide. If you are concerned about a specific model, ask the dealer or manufacturer whether known vulnerabilities and updates apply to your vehicle.
How to Protect Your Car: Step by Step
Before You Start
Your owner's manual, or the manufacturer's online owner resources, for your exact model year and market. All fobs for the vehicle, including spares. A signal-blocking pouch or box (often sold as a Faraday pouch) if you plan to use one. Optional: a steering wheel lock, OBD port lock, or aftermarket immobilizer or tracker.
Step 1: Find Out What Your Keyless System Can Do
Read the keyless entry and key sections of your owner's manual. Look for whether the car uses passive keyless entry, whether the fob has a sleep or motion-sensing mode, and whether keyless entry can be turned off in the vehicle settings or with a button sequence on the fob. Procedures differ between manufacturers and even between models from the same brand, so follow only the steps written for your vehicle.
Step 2: Disable Keyless Entry if Your Vehicle Supports It
If your manual describes a way to switch off passive keyless entry or put the fob to sleep, you can use it overnight or whenever the car is parked for a long period. The trade-off is convenience: you may have to press the unlock button or follow a specific procedure each time. Confirm how to restore normal operation before you rely on this, so you are not locked out of your own car.
Step 3: Store Every Fob in a Signal-Blocking Enclosure
Keep fobs in a signal-blocking pouch or box at home and at work, and include spare fobs, which are easy to forget. A metal container with a well-fitting lid may also work, but test it rather than assuming. Pouches can wear out over time, particularly at seams and closures, so inspect them regularly and replace any that are damaged.
Step 4: Verify the Blocking Works
Put the fob in the pouch or box and close it completely. Carry it to the locked car, stand next to the driver's door, and try the door handle. If the car does not unlock, then with the doors unlocked by other means, try the start button while holding the closed enclosure inside the car. The enclosure is working if the car does not unlock or does not detect the key. If the car responds, the enclosure is not blocking the signal: check that it is sealed properly, then try again, and replace it if it still fails. Do this check for each pouch and each fob, and repeat it from time to time.
Step 5: Keep Fobs Away From Doors and Exterior Walls
Even with a pouch in use, avoid leaving keys on a hook or table by the front door. Storing them further inside the home adds distance and reduces exposure if a pouch is left open by mistake.
Step 6: Add Physical and Secondary Barriers
Steering wheel lock: a visible deterrent that also has to be defeated before the car can be driven. OBD port lock: makes it harder to program a new key through the diagnostics connector. Aftermarket immobilizer: requires a separate code, card or tag before the engine will run, independent of the factory fob. GPS tracker: does not prevent theft but can help locate the vehicle afterwards. Secure parking: a locked garage or a well-lit spot covered by a camera makes the attack harder to carry out unnoticed.
Have aftermarket immobilizers, trackers and any device that connects to the vehicle's wiring installed by a qualified installer. Incorrect installation can cause electrical faults or starting problems and may affect your warranty. Before buying an OBD port lock, check that it fits your vehicle and does not block access needed for inspections or servicing.
Step 7: Keep the Vehicle's Software Up to Date
Some manufacturers release software updates that improve keyless security. Ask your dealer whether updates or security recalls apply to your vehicle, and install any that are available.
Completion Check
You know whether your fob has a sleep mode or whether keyless entry can be disabled, and you have tested how to restore it. Every fob, including spares, is stored in an enclosure that has passed the door-handle test. Keys are not stored near entrances or exterior walls. Any physical locks or aftermarket devices are fitted and working, with professionally installed equipment checked by the installer. You have confirmed with the dealer whether software updates or recalls apply.
Gaps in This Guide
No verified figures on theft rates, specific affected models, product performance or prices were available for this guide, so none are given. Whether your particular vehicle supports keyless disabling, has a motion-sensing fob, uses ultra-wideband or has received security updates depends on its model year, market and equipment. Your owner's manual and the manufacturer or dealer are the authoritative sources for those details.
