Keyless car theft explained: how relay attacks work

What keyless theft is

Keyless entry and push-button start are convenient — your car detects the fob in your pocket and unlocks or starts. Keyless theft exploits exactly that convenience. Instead of stealing your key, thieves trick the car into thinking the key is present. No broken glass, no forced lock, often no sound at all.

How a relay attack works

A relay attack uses two devices and usually two people:

• One person stands near your home — by the front door, a window, or the wall nearest where your keys sit. Their device detects and amplifies the fob’s signal.
• The second stands by the car holding a relay device, which receives the boosted signal and transmits it to the vehicle.
• The car “sees” the key, unlocks, and allows the engine to start. The pair drive away.

Your keys never move. The fob’s signal is simply extended across the distance between your hallway and your driveway. The whole sequence can take well under a minute.

Other keyless methods

Relay isn’t the only approach. Where it fails, organised thieves use:

• Key cloning via the OBD/CAN bus — accessing the car’s wiring (often through a light unit or door) to program a blank key.
• Signal jamming — blocking your fob so the car doesn’t lock when you walk away, leaving it open.
• Game-boy style emulators — handheld devices that generate a working key for certain models in seconds.

Signs you’re at risk

If your car unlocks as you approach with the key in your pocket, it’s keyless — and exposed to relay. High-value and high-demand models are targeted first. Street or driveway parking near a main road increases exposure, because thieves can work quickly and leave fast.

How to stop it — in layers

No single product is enough. Effective protection stacks cheap habits with proper hardware:

• Faraday pouch (free first step) — store keys in a signal-blocking pouch at home. Defeats relay, but only if used every time by everyone.
• Keep keys away from doors and windows — distance reduces the chance of a successful relay pickup.
• Aftermarket immobiliser — the decisive layer. An Autowatch Ghost II, Scorpion X or Meta Trak S5 Deadlock requires a PIN sequence or authorised tag before the engine runs, defeating relay, cloning and emulator attacks alike.
• Thatcham S5 tracker — if the car is taken on a transporter, a monitored S5 with driver tags flags the unauthorised movement and supports rapid recovery.