Modern key fobs solved a small daily annoyance — fishing out a key and pressing a button — by having the fob constantly emit a low-power radio signal that lets a nearby vehicle recognize it and unlock automatically. That same convenience is the vulnerability a technique called a relay attack exploits, letting a pair of thieves capture a fob’s signal from many feet away, often through a wall or window, and beam it to a device sitting next to the car. The car reads the relayed signal as the real key, unlocks, and in many cases starts, all without the fob ever leaving its owner’s pocket or hallway table.
How a Relay Attack Actually Works
A relay attack requires two people and two inexpensive devices working in tandem. One thief stands near the fob, outside a front door, for instance, holding a device that picks up and amplifies its short-range signal. The second thief stands beside the target vehicle with a matching device that rebroadcasts that captured signal to the car’s receiver. Because the vehicle’s proximity system checks only whether it is receiving a valid signal, not how far away the real fob actually is, the relayed transmission is functionally indistinguishable from the genuine one. Investigators have documented the entire process, from capture to a car pulling away, taking well under a minute.
The vulnerability has been demonstrated in controlled testing, not just in isolated theft reports. In a widely cited test, the National Insurance Crime Bureau used a commercially available relay device to unlock 19 of 35 tested vehicles from a range of manufacturers and successfully started and drove off in 18 of them, with the single common factor being that every vulnerable vehicle used keyless entry paired with push-button ignition. Similar independent testing by Germany’s national auto club found that only a small fraction of keyless-equipped vehicles resisted the technique, with the large majority able to be opened and driven away using cheap, off-the-shelf signal-extension equipment.
Why Keyless Systems Are Convenient and Vulnerable at the Same Time
Older remote-entry systems required pressing a button, an action that transmitted a single, limited-range signal only when triggered. Passive keyless-entry systems replaced that deliberate action with constant, automatic broadcasting specifically so a driver could walk up to a locked door or press a start button without ever touching the fob. The tradeoff for that convenience is that the signal thieves need is being sent out continuously, whether the fob’s owner is standing next to the car or asleep on the other side of the house, giving a relay attack a target to intercept at almost any hour.
The Scale of the Problem
Vehicle theft overall has been trending down rather than up: the National Highway Traffic Safety Administration recorded more than 650,000 stolen vehicles in the United States in 2025, still equal to roughly one theft every 48 seconds nationwide but down sharply from prior years. Relay attacks and other electronic methods make up a meaningful and reportedly growing slice of that total as more vehicles ship with keyless entry as standard equipment, even as old-fashioned methods such as stolen keys and unlocked doors continue to account for a large share of thefts.
Insurance coverage for this kind of theft generally works the same as coverage for any stolen vehicle: comprehensive policies typically pay out regardless of the method a thief used, as long as the vehicle was not left unlocked with keys inside in a way an insurer could classify as habitual negligence. That distinction has made insurers active participants in pushing prevention advice, since a theft that could have been blocked by a ten-dollar signal-blocking pouch is a claim most carriers would rather avoid paying in the first place.
What Owners Are Told to Do About It
Because there is no way to prevent a fob from broadcasting its signal while it functions normally, most of the practical countermeasures focus on blocking that signal rather than eliminating it. The National Insurance Crime Bureau recommends storing fobs in a signal-blocking pouch or metal container that acts as a Faraday shield, alongside more general precautions such as always locking the vehicle, never leaving it running unattended, and adding a visible deterrent like a steering-wheel lock or an audible alarm. None of these fixes the underlying vulnerability in the fob itself; they simply interrupt the signal a relay attack depends on before it can reach a thief’s device.
Manufacturers’ Countermeasures
Automakers have started building defenses directly into newer keyless systems rather than leaving the fix entirely to owners. Some fobs now include motion sensors that stop broadcasting after sitting still for a few minutes, closing the window during which a stationary fob can be captured. A growing number of manufacturers have also adopted ultra-wideband radio technology, which can measure the actual time it takes a signal to travel between fob and vehicle precisely enough to detect that a signal has been relayed across a longer path than a genuine nearby fob would need, rejecting the connection instead of unlocking the door. Neither approach has reached the entire vehicle fleet, so the pouch on the counter by the door remains, for now, one of the more reliable defenses available to most drivers.
This article was produced with the assistance of AI and reviewed by Morning Overview editors.
More from Morning Overview
