How does Keyless Entry Relay Attack work?

How a relay attack turns a nearby fob check into a false presence signal

A relay attack does not usually defeat the car’s cryptography. It abuses the distance-based convenience logic, extending the fob’s radio signal so the vehicle treats a distant key as if it is close enough to unlock or authorize start.

The attacker typically works in pairs or with a relay setup. One device listens near the home, pocket, or bag where the fob is present, while another device is held near the vehicle. The car sees a valid exchange, but the radio path has been artificially lengthened.

That means the security boundary is not the identity of the key alone, but the assumption that signal strength or response timing proves physical proximity. When that assumption is weak, convenience features become an access path.

Why keyless entry systems are attractive to attackers

Keyless entry is designed for speed and convenience, so it often grants access with little user interaction. That creates a high-value target because a successful relay attack can produce both entry and, in some vehicles, drive-away capability without the thief ever holding the fob.

The most useful way to think about the risk is that the attack scales better than forced entry. An attacker does not need to break glass or bypass ignition hardware if the vehicle will accept relayed presence as proof of authorization. Our Automotive Cybersecurity Guide covers the broader vehicle-security controls that sit around this problem, including secure onboard communication and anti-theft architecture.

Because the attack path depends on proximity deception, it can be especially effective in driveways, parking lots, and other settings where the vehicle is parked close to homes or other locations where a fob is likely to be near an exterior wall.

How to reduce relay attack exposure without relying on one control

Defence works best as layered friction. Signal-blocking storage, such as a Faraday pouch or box, can stop the relay path when the fob is not in use. Motion-aware fobs or sleep modes add another hurdle by reducing the chance that a dormant key will answer a proximity check while sitting still.

Additional anti-theft controls matter because no single measure is perfect. Owners should look for settings that disable passive entry when they are not needed, and for vehicle features that require stronger confirmation before start authorization. The most effective choice is often the one that reduces the convenience of relay theft without making normal use unsafe or impractical.

For teams evaluating fleet or OEM exposure, the key question is whether the vehicle accepts a simple radio presence check as sufficient proof. If it does, the design should be treated as convenience-first, not as a robust proximity proof, and compensated with stronger layered controls.

Risk and Threat Considerations

Relay attacks are risky because they convert a short-range convenience feature into an access control weakness. The attacker does not need the original fob, only enough time and access to relay its signal from the target location to the vehicle.

Failure mechanism: The vehicle trusts a relayed proximity exchange as if it were a genuine nearby fob interaction, so the attack bypasses the physical-distance assumption behind passive entry.

Impact: The attacker may unlock the vehicle and, in some models, start and steal it without visible damage, which makes the compromise harder to notice and easier to repeat.

Practitioner Guidance

What to prioritise: Treat passive entry as a convenience feature that needs compensating controls, not as a stand-alone theft prevention measure. For households and fleets, the highest-value step is to remove the fob from the attack surface when the vehicle is parked.

What to verify: Confirm whether the vehicle can be started when the fob is inside a shielded container, whether passive entry can be disabled, and whether any movement-based or timeout-based fob behaviour is actually enabled in the current configuration.

Common mistake: Relying on the car’s proximity logic alone and assuming modern keyless entry is inherently resistant to theft. The weak point is usually the trust placed in radio proximity, not the fob itself.

Practitioner takeaway: If proximity is the only thing authorizing access, then relay resistance depends on layered controls outside the radio exchange itself.

Related resources from NHI Mgmt Group

• Keyless Entry Relay Attack
• What happens when a keyless entry attack is detected in a connected vehicle fleet?
• How should OEMs reduce the risk of relay and replay attacks against keyless entry systems?
• Keyless Entry Attack