Skip to main content
InterCar

Resources

Relay attack: how thieves steal keyless cars, and how to stop one

The short answer

A relay attack lets thieves open and start a car with keyless entry while its key is somewhere else, often inside a house. Two devices relay the radio exchange between the car and the key, so the car acts as if the key were beside it. Keeping the key in a tested Faraday pouch or box blocks it.

Francillon, Danev and Čapkun — Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars (NDSS Symposium)Checked October 2, 2026

Last updated

Illustration: the closed box on an entryway table beside a key fob

Faraday key fob box

Scenes marked as illustrations show how the product is used; the product photos show exactly what ships.

In short

  • In a keyless car the car asks and the key answers. A relay simply carries that exchange much further than it was meant to reach.
  • Researchers showed it working on cars from several manufacturers, and a relay theft leaves no sign of forced entry.
  • A Faraday pouch or box works when the key is fully enclosed. Overfilled pouches, gaps and unshielded outer pockets are how they fail.
  • Test yours at the car before you trust it, and shield the spare key as well.
  • Some cars let you put the key to sleep, switch keyless entry off or require a PIN to drive. Your manual says which.
In this guide

Keyless entry was built so you could leave the key in your pocket. The car notices the key is close, unlocks when you touch the handle and starts at the press of a button. A relay attack turns that convenience around: the key never has to leave the house for the car to believe it is standing beside it.

How a relay attack works

The first thing to understand is who does the talking. In a keyless car, the car calls out and the key answers.

That exchange was designed to work over a short range, so that only a key next to the car could answer. A relay stretches the range.

In practice the key does not have to be anywhere near a window or a door for this to matter, but it helps the thieves when it is. A key on a hall table or a hook by the front door is often the closest thing in the house to a car parked in the driveway.

Which cars are exposed

The attack needs passive keyless entry, the kind where you never press a button on the key. A car that only unlocks when you press the key’s button is not exposed to this particular trick.

How common relay theft is in the United States is not known, because nobody counts it separately.

Newer systems are starting to close the gap by measuring the distance to the key rather than trusting that a reply means the key is near. Phone-as-key systems built on ultra-wideband radio are the clearest example.

That does not help the many keyless cars already on the road, and it does not make any system perfect. For those cars, the defense is at your end.

Why it is hard to notice

Most thefts leave something behind: a broken window, a damaged lock, a scratched column. A relay theft can leave nothing at all, and once the car is running it keeps running.

What a Faraday pouch or box does

The fix the researchers proposed is the one you can buy: put the key somewhere radio cannot reach it.

Shields made for car keys hold up well when used properly. Published tests have found pouches blocking the key, and have found the ways they let a signal through.

The failures have one cause in common: a gap. A flap not pressed shut, a pouch so full it cannot close properly, a key slipped into an outer pocket that has no lining, a lining worn through. A rigid box with a clasp avoids most of them at home, and a pouch does the job when you are out.

How to test yours

Never assume a shield works because it says so on the packet. Test it at the car, the way the car would be attacked.

  1. Put the key in the pouch or box and close it completely.
  2. Walk to the car, or sit in the driver’s seat, and try the door handle and the start button.
  3. If the car unlocks or starts, the shield is not working: close it again more carefully, or replace it.
  4. Do the same for the spare key, which is just as useful to a thief.
  5. Repeat the test every few months, because linings wear.

Settings that close the gap

Some cars give you a way to switch the convenience off, or to put the key to sleep when you do not need it. It is worth a few minutes with the owner’s manual to find out what yours can do.

A sleeping key, or keyless entry switched off, gives a relay nothing to carry. A driving PIN works one step later: the car may open, but it will not drive away. That is the same idea as an immobilizer, under your control.

What not to rely on

Kitchen remedies are popular and unreliable. Foil works only if it encloses the key with no gap, every single time. Appliances are worse.

Layers that still help if the signal gets through

A shield protects the key. It is worth adding a layer that protects the car if someone gets it open anyway, and a visible one does part of its work before anyone tries.

The guide to whether steering wheel locks work covers what a lock adds and what it cannot do. Beyond that, the habits are the ones any car benefits from: park in a garage or where it is lit, keep the keys away from the doors and windows of the house, and consider a tracker if your car is one thieves go looking for.

The gear this guide mentions

Each product page lists what it fits and what it does not, the delivery estimate for your order and the return terms, before you pay.

Questions readers ask

Do Faraday pouches work for car keys?

When the key is fully enclosed, yes. In published magazine tests every pouch blocked the key, and the faint leaks found came from pouches that were overfilled or carelessly closed. Wear, gaps and unshielded outer pockets are what make a pouch fail, so test yours at the car before you rely on it.

How do I test a Faraday pouch or box?

Put the key in, close it fully and stand beside the car, or sit in the driver’s seat, then try to unlock or start it. If the car does not respond, the shield is working. Repeat the test now and then, because linings wear, and test the spare key’s pouch too.

Does aluminum foil block a key fob signal?

It can, if the key is wrapped with no gap at all, and a metal tin can work the same way, but neither is dependable from one use to the next. A pouch or box made for the purpose is easier to close properly every time. Whatever you use, test it at the car.

Can thieves copy my key fob signal?

A relay attack copies nothing. It passes the car’s and the key’s signals along live, while both are in range of the thieves’ equipment. Recording a key’s signal to replay later is a different attack, aimed mostly at older keys.

Should I keep my car keys in the microwave or the freezer?

No. Neither is a dependable shield, and both risk damaging the key. Use a pouch or box made for the purpose, and test it at the car.

Can I turn off keyless entry on my car?

On many cars, yes, or you can put the key to sleep. Some cars let you switch keyless features off in the touchscreen menu, some keys stop answering after a button combination, and some go to sleep on their own when left still. The owner’s manual or the dealer will tell you what yours can do.

Where these statements come from

Anything numeric or regulatory on this page carries the document it was read from and the date it was checked against it. A claim with no source is left off the page.

  1. In a passive keyless entry and start system, the car sends beacons on a low-frequency channel, either periodically or when the door handle is operated; when the key detects the signal, it wakes up, computes a response to the car’s challenge and replies on a separate radio channel.

    Francillon, Danev and Čapkun — Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars (NDSS Symposium)Checked October 2, 2026

  2. In a relay attack, the attacker places one device in the proximity of the key and the other in the proximity of the car, then relays messages between the key and the car, enabling the car to be opened and started even if the key is physically far from it.

    Francillon, Danev and Čapkun — Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars (NDSS Symposium)Checked October 2, 2026

  3. The researchers found that relaying the signal in one direction only, from the car to the key, was sufficient while the true distance between key and car remained large — tested up to 50 meters, out of line of sight — and that with their setup the key could be excited from up to 8 meters away.

    Francillon, Danev and Čapkun — Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars (NDSS Symposium)Checked October 2, 2026

  4. They tested a variant of the attack with a relay antenna close to a window, activating a key left inside a closed building on a table; if the car is parked close to the building, the attacker can open and start it without entering the building.

    Francillon, Danev and Čapkun — Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars (NDSS Symposium)Checked October 2, 2026

  5. The researchers tested 10 car models from 8 manufacturers — one of them an aftermarket system, tested in the laboratory only — and showed that their passive keyless entry and start systems were vulnerable to certain types of relay attacks.

    Francillon, Danev and Čapkun — Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars (NDSS Symposium)Checked October 2, 2026

  6. None of the cars they evaluated stopped the engine if the key was no longer detected after the engine had been started, and they note that a relay theft leaves no physical traces of entry.

    Francillon, Danev and Čapkun — Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars (NDSS Symposium)Checked October 2, 2026

  7. The National Insurance Crime Bureau (NICB) reported that its extensive testing of a relay attack device showed it works on many cars and trucks with a keyless remote and push-button ignition: it unlocked them and was able to start the majority of them, potentially letting thieves take valuable vehicles without leaving a trace of evidence.

    NICB — Annual Report (relay attack device testing)Checked October 2, 2026

  8. AAA describes a relay attack as thieves using an antenna to pick up the signal from a key fob, amplify it, and unlock and start the vehicle at a distance where the key otherwise would not work. It says the method can take less than 60 seconds and is most effective when the key fob is left close to the vehicle, such as near an exterior door.

    AAA — How to protect yourself from keyless car theftChecked October 2, 2026

  9. CBS News reported that NICB does not break down exactly how vehicles were stolen, and that the auto industry does not track this data either.

    CBS News — Keyless vehicle theftsChecked October 2, 2026

  10. The Car Connectivity Consortium’s Digital Key standard uses ultra-wideband time-of-flight measurement, which it calls secure ranging, to prevent attackers using relay attacks based on signal amplification to trick a vehicle into thinking a mobile device is nearby when it is not.

    Car Connectivity Consortium — CCC Digital Key, The Future of Vehicle AccessChecked October 2, 2026

  11. The same researchers proposed placing the key inside protective metallic shielding, creating a Faraday cage around it, so that it does not receive any signals from the car, relayed or direct. They note that designing a good Faraday cage is challenging, but that this countermeasure would make the relay attack very difficult in practice.

    Francillon, Danev and Čapkun — Relay Attacks on Passive Keyless Entry and Start Systems in Modern Cars (NDSS Symposium)Checked October 2, 2026

  12. Which? notes that a key needs to be completely surrounded by a metal layer, without even the slightest gap, to be protected from a relay attack.

    Which? — How easy is your car to steal?Checked October 2, 2026

  13. In a What Car? test of eight Faraday pouches, each tried with the key of one keyless car, every single pouch successfully blocked the signal emitted from the key.

    What Car? — Faraday pouch testChecked October 2, 2026

  14. Auto Express tried pouches with three keyless cars, then tumbled them 1,200 times with keys inside to simulate 18 months of handling twice a day. It found that one let through a very faint signal when the pocket was overfilled and fastened clumsily, and that another leaked slightly when very full.

    Auto Express — Faraday bag car key signal blocker testChecked October 2, 2026

  15. AAA’s test for a Faraday bag: sit in the driver’s seat, place the key fob in the bag and seal it, then try unlocking or starting the car. If it does not respond, the bag is working.

    AAA — How to protect yourself from keyless car theftChecked October 2, 2026

  16. Which? advises double-checking that a Faraday bag effectively blocks the signal, by seeing whether the car unlocks with the key in the bag, before trusting it — and not forgetting an extra one for the spare key.

    Which? — Keyless car theft: why aren’t car manufacturers doing more?Checked October 2, 2026

  17. AAA notes that some cars allow owners to disable keyless features such as keyless entry and ignition, typically from the touchscreen menu, and that because each car is different, owners should check the owner’s manual or ask a dealership.

    AAA — How to protect yourself from keyless car theftChecked October 2, 2026

  18. Thatcham Research describes keys with motion sensors that detect when the key has been stationary for a period and trigger a sleep mode, after which it no longer responds to attempts to relay its signal. Some go to sleep in one or two minutes, others after 15 or even 30 minutes.

    Thatcham Research — carmakers introduce sleeping fobs to frustrate keyless thievesChecked October 2, 2026

  19. A Mercedes-Benz service document describes the KEYLESS-GO function of certain keys being deactivated by a double press of the lock button, and activated again when any button on the key is pressed.

    Mercedes-Benz — KEYLESS-GO service information (NHTSA)Checked October 2, 2026

  20. Tesla’s Model 3 manual describes PIN to Drive, a setting that prevents the car from being driven until a 4-digit PIN is entered.

    Tesla Model 3 Owner’s Manual — Safety and Security Settings (archived copy)Checked October 2, 2026

  21. The Associated Press advises against keeping a key fob in the microwave or the freezer: it does not have the same effect as a Faraday bag, and you risk damaging the key.

    Associated Press — One Tech Tip: protecting your car from keyless vehicle theftsChecked October 2, 2026

Find the piece that fits

Every product page says which plugs, chargers or cars it fits, shows the delivery estimate for your order and links the return terms before checkout.