Keyless Entry Relay Attack

What Makes a Keyless Entry Relay Attack Different

A keyless entry relay attack does not break the car’s immobiliser directly. It extends the range of a legitimate key fob signal, so the vehicle believes the authorised key is nearby and grants access as if the owner were present.

This matters because passive entry systems are designed for convenience, not for resisting adversaries who can capture and rebroadcast radio communication. The attack succeeds by abusing the trust relationship between the vehicle and the fob, rather than by defeating the vehicle’s core cryptography.

The same pattern appears across modern vehicle theft: the most valuable weakness is often not the car’s electronics alone, but the assumption that proximity equals legitimacy. NHI Management Group’s Automotive Cybersecurity Guide covers this broader vehicle-security context, including connected-car attack surfaces and automotive risk management.

How the Relay Technique Works

The attacker typically uses two devices, one near the home or place where the fob is stored and another near the vehicle. The first device captures the weak, short-range exchange from the fob; the second relays that signal to the car in real time. Because the car receives a valid response, it unlocks and may allow the engine to start.

The technique is effective because radio proximity checks are easy to fool when the system has no additional liveness check, movement check, or owner-presence requirement. Signal amplification, rebroadcasting, and repeated attempts can all increase the chance of success when the fob remains in passive mode.

That is why many defences focus on breaking the attacker’s ability to preserve signal fidelity. A motion-sensing fob can stop responding when it is stationary, and a shielded pouch or metal container can block the signal path altogether.

Defensive Controls That Reduce Exposure

Defence starts with understanding how the vehicle decides a key is “near enough.” If the car supports settings that disable passive entry or require an explicit button press, those settings reduce exposure by removing the always-on proximity assumption. Owners can also keep fobs away from doors and windows, especially where attackers may try to collect the signal from outside the home.

Physical signal shielding is a simple compensating control when stronger vehicle settings are unavailable. It is not a perfect fix, but it can prevent opportunistic relay attempts by making the fob harder to reach. Motion-aware fobs add another layer by refusing to transmit when they have not moved for a period of time.

More broadly, the control model is layered: limit passive entry, constrain where the fob is stored, and use vehicle settings that reduce trust in proximity alone. That combination is more resilient than relying on any single control.

What to Verify After a Suspected Relay Theft

If a relay attack is suspected, the main concern is not just the missing vehicle, but whether access was gained without leaving obvious physical damage. Owners should treat the event as a security incident, because the vehicle may have been entered or started without the key ever leaving the home.

After a suspected incident, review what was taken, whether the vehicle was moved, and whether stored items or onboard settings could have been altered. If the vehicle uses paired phones, telematics apps, or stored garage-access features, those linked access paths should also be reviewed because they can broaden the post-theft impact.

CISA cyber threat advisories are a useful reference point for understanding how trusted access paths can be abused and why compensating controls matter when a simple trust assumption is attacked.

Risk and Threat Considerations

Relay attacks are dangerous because they exploit a design choice that equates proximity with trust. That makes the vehicle vulnerable even when the legitimate fob is physically present and the owner believes the car is secure indoors.

Failure mechanism: The attacker relays the fob’s radio exchange in real time, preserving the appearance of legitimate presence while bypassing the intended distance check.

Impact: The vehicle can be unlocked and driven away without visible forced entry, increasing theft risk and reducing the chance that the owner notices the compromise immediately.

Practitioner Guidance

Why practitioners should care: Vehicle owners and fleet managers should treat passive-entry convenience as a risk trade-off, not a default safe mode. Where the vehicle supports it, disabling passive entry or requiring a deliberate unlock action materially reduces relay exposure.

What to watch for: Unusual unlock or start events, repeated fob responsiveness issues, and thefts that leave no sign of forced entry are all signals that a relay-style compromise may be in play.

Practitioner takeaway: The best practical defence is to remove unnecessary trust in passive proximity, then add physical shielding and behaviour-based fob controls where the vehicle supports them.

Related resources from NHI Mgmt Group

• What happens when a keyless entry attack is detected in a connected vehicle fleet?
• How should OEMs reduce the risk of relay and replay attacks against keyless entry systems?
• Keyless Entry Attack
• What breaks when keyless vehicle access is vulnerable to relay attacks?