What Is a Relay Attack and How Can It Lead to Car Theft?

Keyless entry made one everyday interaction almost invisible.

You approach your vehicle with the key fob in your pocket or bag. The vehicle recognizes an authorized credential nearby. You unlock the door and, depending on the system, start the vehicle without inserting a physical key.

That convenience depends on electronic communication between the vehicle and its authorized key.

A relay attack targets that relationship.

Instead of physically taking the original key, the attack can make the vehicle interpret a relayed signal as if the legitimate key were close enough to authorize access.

That distinction explains both what makes relay theft different and why simply having your keys after a vehicle disappears does not necessarily tell you how it was stolen.

What Is a Keyless Relay Attack?

A keyless relay attack is a form of vehicle theft in which signals associated with an authorized keyless credential are relayed so the vehicle may interpret the legitimate key as being nearby when it is not.

At a conceptual level, think of the difference this way:

Normal keyless operation

Authorized key nearby => Vehicle recognizes the credential => Access or starting may be authorized

Relay attack

Authorized key is elsewhere => Communication is relayed => Vehicle may interpret the credential as nearby

The legitimate key itself does not necessarily need to be physically stolen.

The important concept for an owner is not the equipment used to perform the attack. It is the relationship being targeted:

The attack targets the vehicle’s understanding of proximity, not necessarily possession of the original key.

 

Why Can Keyless Entry Create This Kind of Risk?

Keyless systems are designed around convenience.

With passive keyless entry and start systems, the driver may not need to remove the fob from a pocket or bag to perform ordinary vehicle functions. The system determines whether an authorized credential is sufficiently nearby.

That changes the access model.

A traditional mechanical key largely asks: Do you physically possess the correct key?

A passive keyless system can involve another question: Does the vehicle recognize an authorized credential as being within the expected proximity?

Relay attacks exploit that second relationship.

This does not mean keyless vehicles are inherently easy to steal, nor does it mean every keyless system works identically. Security architectures vary by manufacturer, model, model year and technology generation.

The narrower lesson is that convenience changed the way some vehicles establish authorized access, creating a different potential attack surface.

 

Is a Relay Attack the Same as Copying or Stealing Your Key?

No. A relay attack should not automatically be treated as synonymous with key cloning, unauthorized key programming or every form of electronic vehicle theft.

The defining idea is relay.

The legitimate credential remains part of the interaction, but its communication is relayed so the vehicle may respond as though the key were closer than it actually is.

Other theft methods can involve different ways of obtaining, creating or manipulating vehicle authorization.
Those belong to the broader category of modern vehicle theft, but they are not all relay attacks.

Related: How Vehicle Thieves Really Work: Modern Vehicle Theft Methods Explained

 

Can a Relay Attack Unlock and Start a Vehicle?

Potentially, depending on the vehicle and security system.

In 2016, the National Insurance Crime Bureau conducted informal testing using relay-attack technology. The device was able to unlock 19 of 35 tested vehicles and start and drive 18 of them.

That testing demonstrated that relay attacks could affect multiple keyless systems. It should not be interpreted as evidence that the same proportion of vehicles is vulnerable today or that all modern keyless vehicles share the same security architecture.

Vehicle technology has continued to evolve since that testing, and manufacturers may use different designs and countermeasures.

That is why statements such as “all push-button cars can be stolen this way” go beyond what the evidence supports.

Push-button start tells you something about how the driver interacts with the vehicle. It does not, by itself, establish relay vulnerability.

 

Would There Be Signs of Forced Entry?

Not necessarily.

A theft involving electronic authorization may not produce the signs people traditionally associate with stealing a car.

There may be no smashed side window. The owner may still have the original keys. There may be no immediately obvious evidence showing how access occurred.

But those observations establish only what is visible after the event.
They do not prove that a relay attack occurred.

A vehicle disappearing without broken glass or a missing key can have more than one possible explanation.

The distinction is important:

• No visible forced entry is an observation.
Relay attack is a possible explanation.
• Evidence should not become a diagnosis without enough information to support it.

 

Is Every Keyless Car Vulnerable to Relay Theft?

No universal assumption should be made.

Keyless systems have changed over time, and different manufacturers and vehicles can use different security designs and countermeasures. Even within one brand, features may vary by model, model year, market and equipment.

Some modern key technologies have been designed to address relay-related risks, while manufacturers may also provide security guidance for particular vehicles.

That makes manufacturer information for the specific vehicle more useful than assumptions based only on whether the car has a Start button.

Instead of asking only “Is my car keyless?”.

A better question is:

“How does my particular vehicle’s keyless system work, and what security guidance does its manufacturer provide?”

 

How Can Drivers Reduce Relay-Attack Risk?

Relay-specific prevention starts with the credential itself.

Police and vehicle-security organizations commonly recommend keeping keyless fobs, including spare keys, away from the exterior perimeter of the home and considering a properly functioning signal-blocking pouch or container.

For vehicles that allow keyless wireless functions to be disabled when they are not needed, owners can check the manufacturer’s instructions for their specific key and vehicle.

Physical security can also provide an independent layer because it addresses a different part of the problem.

The principle is straightforward.

Reduce unnecessary key communication and avoid relying on one security layer alone. For relay-specific risk, practical steps can include:

• following the manufacturer’s current security guidance for the vehicle;
• keeping primary and spare fobs away from doors and windows when practical;
• checking periodically that any signal-blocking pouch or container still blocks communication;
• determining whether the vehicle allows keyless functions to be disabled when not needed.

These measures can reduce exposure to this particular method. They should not be interpreted as guarantees against vehicle theft in general.

 

Does a Faraday Pouch Prevent Relay Attacks?

A properly functioning signal-blocking pouch is intended to prevent the key fob’s wireless communication from reaching beyond the pouch.

That directly addresses the signal relationship on which a conventional relay attack depends.

But two cautions matter.

First, the pouch has to work. Security guidance recommends periodically checking signal-blocking products rather than assuming they remain effective indefinitely.

Second, relay protection is method-specific.

A signal-blocking pouch does not make the entire vehicle theft-proof or address unrelated methods involving different credentials, electronics, force or physical removal.

Protection against one theft method is not protection against every theft method.

 

The Key Does Not Always Have to Move

The defining idea behind relay theft is surprisingly simple. The legitimate key can stay where it is while the vehicle is led to interpret its signal as being nearby.

That helps explain how a vehicle may potentially be accessed even though the owner still possesses the original key.

But relay attack is only one possible explanation.
Other theft methods can involve different credentials, electronic systems or even physical removal.

 

FAQ - What Is a Relay Attack and How Can It Lead to Car Theft?

What is a relay attack on a car?

A relay attack is a form of keyless vehicle theft in which communication associated with an authorized key is relayed so the vehicle may interpret the key as being nearby even when it is not.

Does a thief need to steal my key for a relay attack?

Not necessarily. The authorized key can remain elsewhere while its communication is relayed toward the vehicle.

Are relay attacks only possible on keyless cars?

Relay attacks are associated with passive keyless systems that rely on proximity-based communication with an authorized credential. Vehicle designs vary, so vulnerability should not be assumed solely because a vehicle has push-button start.

Does having my keys after the theft mean it was a relay attack?

No. Having the original keys tells you they were not obviously taken from you. It does not identify the method used to steal the vehicle.

Can a Faraday pouch help protect a keyless car?

A properly functioning signal-blocking pouch can reduce exposure to conventional relay attacks by blocking communication from the stored key. It should not be treated as protection against every vehicle-theft method.

Is relay theft the same as key cloning?

No. Relay attacks, key cloning and unauthorized key programming describe different concepts. A relay attack specifically involves relaying communication associated with an authorized credential.