The convenience of a keyless car, one that unlocks as the owner approaches and starts at the push of a button, rests on a constant, invisible radio conversation between the vehicle and the fob in a pocket or bag. That same convenience has opened a door for thieves, who have learned to hijack the conversation with inexpensive electronics. Using a pair of relay devices, criminals can trick a car into behaving as though its key is right beside it, even when the fob is sitting on a kitchen counter dozens of feet away.
The result is a theft that can unfold in under a minute, in near silence, and without any broken glass or forced locks. To a passerby, or even a security camera, it can look like nothing more than someone walking up to a car, opening the door and driving off.
How a relay attack fools a keyless car
Modern passive entry and push-to-start systems judge whether the key is nearby by measuring the strength of the radio signal passing between the fob and the car. A relay attack exploits that assumption. It typically requires two people working together, each carrying a device. One stands near the vehicle while the other gets close to where the key is kept, often just outside a house or beside a restaurant table. The device near the key captures its faint signal, amplifies it and relays it to the second device by the car, which rebroadcasts it as if the fob were inches from the door handle.
Because the car simply detects a valid key signal at what appears to be close range, it unlocks and permits the engine to start. The system is working exactly as designed; it has just been deceived about where the key actually is. Security researchers describe the equipment involved as compact and increasingly affordable, which is part of why the technique has spread.
What investigators found when they tested the devices
The National Insurance Crime Bureau, which tracks vehicle theft on behalf of insurers, obtained one of the relay units after the public was warned about mysterious devices being used to open cars caught on surveillance footage. In its testing, the bureau found that the device worked only on cars equipped with keyless remotes and push-button ignitions, and that it was able to unlock more than half of the vehicles tried. The organization has been monitoring this style of theft for years, noting how difficult it is to detect because it leaves no physical trace.
That invisibility is a core part of the threat. With no broken window or damaged lock, owners are often left with no explanation for how their car vanished, and police have little forensic evidence to work with. Insurers, meanwhile, have tied the persistence of thefts in some high-crime areas to keyless-entry exploitation rather than old-fashioned break-ins.
Why the term relay is more accurate than copy
It is worth clarifying what the devices actually do. Rather than permanently duplicating or cloning a key, a relay attack forwards the fob’s live signal in real time, extending its reach so the car thinks the key is present. The fob is not copied so much as it is remotely borrowed for the moment it takes to unlock and start the vehicle. Once the car is driven away and the relayed signal is out of range, some vehicles will keep running until they are switched off, which is why thieves aim to drive off before the engine is stopped.
Understanding that distinction matters for defense. Because the attack depends on reaching the fob’s signal, the most effective countermeasures focus on blocking or containing that signal rather than on the car’s software.
Simple defenses that break the signal chain
The most widely recommended safeguard is to block the fob’s radio emissions when it is not in use. A signal-blocking pouch, often called a Faraday bag, is designed to contain the fob’s signal so amplifying equipment cannot reach it. Storing the key inside a metal container such as a tin or a closed metal box can achieve a similar effect by shielding the radio waves. Security guidance also suggests keeping fobs away from exterior walls, doors and windows at home, since relay devices work by getting close enough to the key from outside.
Additional physical deterrents still have value. A steering-wheel lock or a wheel clamp does nothing to stop the electronic unlock, but it can prevent the car from actually being driven away, forcing thieves to spend time and make noise. Reporting on keyless theft protection notes that layering these low-tech measures on top of signal shielding raises the effort required enough to send opportunistic thieves looking for an easier target.
What carmakers are doing about it
Manufacturers have not ignored the problem. Some newer fobs include a motion sensor that puts the key to sleep when it has been still for a while, cutting off the signal a relay attack needs while the car sits parked overnight. Automakers are also experimenting with more precise distance measurement, using timing and other radio characteristics to verify that a key is genuinely close rather than merely detectable, an approach intended to catch the tell-tale delay a relay introduces.
For now, though, the practical burden falls on owners of keyless cars, and the fix is refreshingly analog. Shielding the fob, keeping it away from the front of the house and adding a visible physical lock together undo much of the advantage a cheap relay provides. The technology that makes a car open itself as the driver walks up is convenient by design, and the same design is what these simple habits are meant to protect.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- More than 60,000 people flee the Spokane area as complex fires overrun 600 structures
- 11 engines built to run well past 200,000 miles
- Card skimmers hidden on gas pumps and ATMs are draining accounts, and here’s the tell
- The FBI says hackers are hijacking outdated home routers, and it named the models to check
