Keyless Car Theft: Understanding and Preventing Relay Attacks

How Passive Keyless Entry Works

A passive keyless system lets the car and fob talk to each other automatically. When you touch a door handle or press the start button, the car sends out a short-range, low-frequency signal. If your fob is close enough to hear it, the fob answers with an encrypted response on a different radio frequency. If the response checks out, the car unlocks or allows the engine to start.

The encryption itself is generally not what thieves defeat. The weak point is the assumption behind the design: the car treats a valid reply as proof that the key is physically nearby. Many older systems cannot tell whether the reply came from a fob inches away or one much farther off whose signal has been carried closer.

This differs from the remote transmitter function, meaning the lock and unlock buttons on the fob. Those buttons send a one-way rolling code when pressed. Relay attacks exploit the automatic, hands-free conversation, not the button press.

How a Relay Attack Works

A relay attack generally involves two people and two devices, often called a key fob repeater or relay kit. One person stands near the car with one device. The other gets as close as possible to the place where the key is kept, such as near a front door, a hallway table or a window, or near the owner in a public place.

The device at the car picks up the car's challenge signal and sends it to the second device. That device rebroadcasts the challenge near your fob. The fob answers as it normally would, and the reply travels back to the car. The car sees a valid response and unlocks. Once inside, the thief presses the start button while the relay is still active, and the engine starts.

The relay does not crack or copy the key's code. It forwards a live conversation in real time. That is why the attack can be quick and quiet, and why it often leaves no sign of forced entry. Once the car is running, many vehicles are designed not to shut off the engine if the key goes out of range, so the thief can usually drive until the car is switched off.

How Relay Theft Differs From Other Key Fob Car Theft

Key fob car theft is a broad label. Relay attacks are one technique among several, and the right defense depends on which one you are trying to stop.

Method | What it targets | Does it need your key nearby? | Main defenses; Relay attack | Passive keyless entry and start | Yes, the real fob must be within the relay's reach | Signal-blocking storage, fob sleep or motion-sensing modes, disabling passive entry, physical deterrents; Signal jamming | Lock command from the remote transmitter | No, it stops the car from locking when you walk away | Confirm the car actually locked with lights, sounds or a handle check; Key programming through the diagnostic port | Vehicles that allow new keys to be added through the OBD port | No, thieves add their own key | OBD port lock, aftermarket immobilizer, alarm that triggers on entry; CAN injection | The vehicle's internal network, reached through wiring, often behind a headlight or bumper | No | Physical deterrents, tracking, manufacturer software updates where offered; Theft of the physical key | Any vehicle | They take the key itself | Keep keys out of sight and away from entry points

Keyless entry car theft is often blamed on relay attacks when another method was used, and the reverse also happens. If your car is stolen, it may not be possible to know which technique was involved.

Which Vehicles Are Most Exposed

Any vehicle with passive keyless entry and start can be vulnerable unless its key system has a specific countermeasure. Exposure varies by manufacturer, model year, generation and sometimes trim, since the same nameplate may offer keyless entry only on certain versions.

Some manufacturers have added defenses to newer systems. One common measure is a motion sensor in the fob that puts it to sleep after it sits still for a while, so a key resting on a counter stops answering. Another is ultra-wideband (UWB) technology, which lets the car measure how long the signal takes to travel and estimate the real distance to the key. Relayed signals take slightly longer, which can reveal the attack. Whether your vehicle has either feature is model-specific, so check your owner's manual or ask a dealer instead of assuming.

Phone-as-key systems that use a smartphone in place of a fob work on similar proximity principles. Their resistance to relaying depends on the technology and safeguards a particular manufacturer uses.

How to Prevent Keyless Car Theft

No single step makes a car theft-proof. The most practical approach is layering: block the signal, make the car harder to drive away and make it easier to recover.

Block or Silence the Key Signal

Store fobs in a signal-blocking pouch or box, often sold as Faraday pouches. Quality varies and the lining can wear out, so test it: put the fob inside, walk up to the car and try the door handle. If the car unlocks, the pouch is not working. Keep spare fobs shielded too. A spare in a kitchen drawer can be relayed just as easily as your everyday key. Use the fob's sleep or deactivation mode if your vehicle offers one. Some fobs can be switched off with a button sequence and woken up with a press. The procedure differs by manufacturer, and the owner's manual usually describes it. Consider turning off passive entry if your vehicle's settings menu or a dealer can do this. You would then unlock with the fob buttons, which removes the hands-free conversation relay attacks depend on. Keep keys away from exterior doors and windows. Distance does not guarantee safety, but it can make a relay harder to carry out.

Make the Car Harder to Drive Away

Use a visible steering wheel lock or pedal lock. It does not stop the car from unlocking, but it adds time, noise and effort, and the visible deterrent may lead a thief to move on. Fit an OBD port lock if your vehicle is a target for key programming theft. It makes adding an unauthorized key harder. Ask a qualified installer about an aftermarket immobilizer. Some require a PIN code or a separate tag before the engine will start, adding a check that relaying the factory key cannot satisfy. Park in a locked garage when possible. Where that is not an option, a well-lit spot that is visible from the house or covered by a camera can help. Always confirm the car actually locked by watching for the lights, listening for the lock sound or trying the handle, which guards against signal jamming.

Improve the Odds of Recovery

Consider a GPS tracker, either a professionally installed unit or a hidden consumer tracker. Thieves often look for obvious trackers, so placement matters. Activate the manufacturer's connected services if your vehicle has them. Some can locate the car or alert you to unexpected movement. Keep records that establish proof of ownership, such as title and registration copies, the VIN, purchase documents and current photos of the vehicle. Store them somewhere other than the car.

Keep Software Current

Some manufacturers release software updates or recalls that change how keyless systems behave or that add anti-theft features. Keep up with recall notices and ask your dealer whether updates are available for your model year.

Will Disabling Keyless Features Leave You Stranded?

Generally, no. Turning off passive entry usually leaves the fob buttons working. Most keyless fobs also contain a mechanical key blade that opens the driver's door if the fob battery dies or the electronics fail. Many push-button-start vehicles have a backup method, such as holding the fob against the start button or placing it in a marked spot so the car can read it without battery power. The exact procedure varies, so learn your vehicle's method before you need it. If you still cannot get in or start the car, roadside assistance from an insurer, auto club or the manufacturer may be able to help.

What to Do If Your Car Is Stolen

Report the theft to local police right away and get a report number. Provide the VIN, plate number, description and any tracker or connected-service location data. Contact your insurer promptly. Comprehensive coverage typically applies to theft, but terms differ, so check your policy. Notify your lender or leasing company if the vehicle is financed. If the vehicle has a manufacturer app or connected service, contact the provider. Some can help police locate the car. If the car is recovered, or if any keys are missing, ask a dealer or qualified locksmith about key programming that erases all stored keys and re-registers only the ones you hold. This prevents a key added by a thief from working again.

The Bottom Line

Relay attacks exploit the convenience of passive keyless entry by making a distant key seem close. They do not break the encryption, so the most effective defenses stop the key from responding at all: shielded storage, fob sleep modes or turning off passive entry. Pair those with physical deterrents and a way to track the vehicle. Because vulnerability and built-in protections vary by make, model year and trim, check what your own vehicle's key system supports and build your defenses around it.