Two thieves, a pair of radio relays and a fob inside the house: how keyless car theft works, what the ADAC tests found, and which cheap steps still help.
A relay attack lets two thieves pass the radio conversation between a keyless car and its fob without altering it, so encryption does not matter. Immobilisers stop hot-wiring and cut theft by about 40%, but they can be bypassed. Ultra-wideband ranging resisted relay equipment in a 2024 test of 698 vehicles.
When the German motoring club ADAC put 698 vehicles in front of relay equipment in 2024, 629 of them could be unlocked and started. The vehicles that held out had one thing in common: ultra-wideband ranging.
What is a relay attack on a keyless car?
A relay attack, sometimes called the two-thief attack, never cracks the code a car and its key exchange. The criminals simply carry the conversation between the two, passing messages along unchanged and not even needing to read them. The car believes the key is beside it, because as far as it can tell, it is.
Picture a doorman who demands a password, with two impostors acting as a relay: one at the door, the other next to the real guest across town, each repeating whatever the other side says. Security researchers use a building door and a smart card in someone's handbag as their standard illustration. The attacker at the door triggers the challenge, a partner near the card's owner feeds it to the card, and the reply makes the return trip until the door opens.
Cars with passive keyless entry and start are a documented target. The thieves boost or copy the key's radio signal, which is a job for fairly simple amplifiers, and then they only have to open the door, press the start button and leave. The alarm stays quiet, and the only evidence of the theft is footprints.
The car believes the key is beside it, because as far as it can tell, it is.
Why doesn't strong encryption stop a relay attack?
Because the attack never has to understand the message. Researchers who demonstrated the technique on ten vehicles from eight manufacturers found that their relays worked whatever the modulation, the protocol or the strength of the authentication and encryption. A courier can deliver a sealed envelope without ever opening it, and the recipient still accepts it.
That shifts the weak point from the maths to the question the car is really asking. A passive system wants to know whether the key is close, and its only evidence is whether radio reaches it. Fobs normally work within about 5 to 20 metres (16 to 66 ft). A relay stretches that reach across a driveway, a front door and a hallway table.
How does keyless entry actually work?
A key fob carries a short-range radio transmitter. Press a button and it sends a coded signal to a receiver in the car, which locks or unlocks the doors. Most systems on North American cars run at 315 MHz, while European, Japanese and other Asian cars mostly use 433.92 MHz.
The idea is older than most drivers realise. Paul Lipschutz, who worked for the security supplier Nieman, patented remote keyless entry in 1981 after a submission in 1979, using a handheld fob that streamed infrared data. In some regions the whole category is still called a Plipper. The Renault Fuego carried the first handheld transmitter in 1982, and several American Motors cars offered one as an option in 1983. General Motors made the feature widely available in the United States on several models from 1989.
Infrared gave way after a European frequency was standardised in 1995, and systems since the mid-1990s have added encryption and rotating entry codes. The next step, passive entry, arrived on the 1993 Chevrolet Corvette: the car locked and unlocked itself as the owner approached, though the engine still started with a conventional key. Today some passive systems also start the car, and phone-as-a-key versions sit alongside fobs.
Programming has moved out of the owner's hands. Remotes from 1998 to 2012 could often be set up by the user, while those from 2013 onwards need a dealer or a locksmith with software. Ford, meanwhile, has offered a door keypad since the 1980 model year; in 2019 it was on 90% of the range, and it was still on sale in 2025 next to fobs and phone keys.
What is a replay attack, and what are rolling codes?
In a replay attack a thief records the signal a fob sends, using a device known as a code grabber, and plays it back later. Manufacturers answered with rolling codes: the fob and the car each contain a pseudorandom number generator, kept in step, so every press sends a different, encrypted code that a recording cannot reuse.
The defence has a known gap. In 2015 the researcher Samy Kamkar built a cheap gadget no bigger than a wallet and showed it at the DEF CON 23 conference. It jams the car's reception while recording two presses of the fob. The owner's first press is held back, the second is used to open the car, and the first, still unused, is replayed to the car after the owner has walked away. Kamkar said the flaw was an open secret in the trade for years, though nobody had shown it working.
Thefts of luxury cars using this kind of approach have been reported when the owner's fob was kept close to the front door. A criminal ring in Southern and Eastern Ontario is reported to have stolen about 100 vehicles with it. Keeping the fob in a tin box is among the suggested workarounds.
How serious is the real-world threat?
The evidence points two ways. Assessments differ. The risk of a keyless car being stolen is described as high, and the 2024 ADAC results back that up. Yet although academic teams have staged demonstration thefts of high-end luxury cars with commercially available radio tools, real cases of this kind have not been very prevalent.
News media have also reported suspected cases involving radio repeaters, while noting that no such devices had been found. The same reports speculate that wrapping a fob in aluminium foil or storing it in a freezer could block the signal. Treat that as speculation, not a tested cure.
Insurers have taken a view of their own. In October 2014 some British insurers were found to be refusing cover for certain cars with keyless ignition unless extra mechanical locks were fitted, because of weaknesses in the keyless system. Keyless ignition, in other words, does not bring better security by default.
What does an immobiliser really stop?
An immobiliser is an electronic device that stops the engine starting unless the correct key, either a transponder or a smart key, is present. It blocks hot-wiring after a thief has got inside. Research has found that applying immobilisers across the board cut the car theft rate by 40%.
The idea is nearly as old as the car alarm. St. George Evans and Edward Birkenbeuel patented an electric immobiliser and alarm in 1919, built around a three-by-three grid of double-contact switches on a panel inside the car. The owner had to remember the setting each time; modern systems arm themselves.
Early electronic versions held a static code in the key. A loop around the lock barrel read it, and the engine control unit checked it for a match. If the code was wrong, the unit would not allow fuel flow or ignition. Later designs use rolling codes or advanced cryptography so the code cannot simply be copied from the key or the unit. The chip in the key is woken by a faint electromagnetic field and broadcasts a unique binary number; the unit starts the fuel-injection sequence only when that number is current and valid.
Some cars go further. A wrong key can trigger a timed no-start condition, and the most advanced systems use a satellite or mobile phone link to tell a security firm that someone tried to code a new key. Because the engine control unit may also log speed, temperature, location, throttle position and yaw angle, the same hardware can feed insurance investigations and warranty claims.
When did immobilisers become compulsory?
| Market | Immobilisers required in all new cars |
|---|---|
| Germany | From 1 January 1998 |
| United Kingdom | From 1 October 1998 |
| Finland | From 1998 |
| Australia | From 2001 |
| Canada | From September 2007 (all new lightweight vehicles and trucks built there) |
The payoff was measurable. A study published in the Economic Journal in 2016 examined 1995 to 2008 and put the fall in overall car theft at about 40%. Prevented thefts were worth at least three times the cost of fitting the devices.
Where do immobilisers fall short?
They defend the ignition, not the door, and they have their own cracks. Many rely on the Megamos chip, which researchers have shown can be cracked, and it is only one of many transponder types in use. A thief attacking one in the real world would work on the vehicle, not the key, and it is usually quicker to program a fresh key into the car than to clone an existing one.
Some systems even hold on to the last valid key code for a few minutes, so they may accept a non-transponder key after the original has left the ignition. In London, police say that half of the 20,000 car thefts a year now involve key-cloning kits that plug into the diagnostic port, bought online, or other tools that bypass the immobiliser.
The starkest lesson came from North America. Many Kia and Hyundai models sold in the United States after 2010 and before mid-2021 lacked an immobiliser, and they became favoured targets in the early 2020s, notably in Milwaukee County, Wisconsin and in Columbus, Ohio. A design flaw that let a USB cable stand in for the key drove sharp rises in thefts of the affected cars in both the United States and Australia in 2022, and a viral TikTok trend called the Kia Challenge spread the method.
Which cars do thieves actually take?
It depends on place and age. Older vehicles often have weaker security, and thieves have had longer to learn their faults, while scrap metal and spare part prices can pull thieves toward them. British figures for 2018 had the Mercedes-Benz C-Class at the top of the list, ahead of the BMW X5, and police pointed to the rising number of keyless cars as a contributing factor.
In the United States the Dodge Challenger and Charger top the lists, especially those with the Hellcat engine, and the Los Angeles Police Department reported a rise of more than 1,000 percent in Chevrolet Camaro thefts in 2024. In Israel the police figures for 2018 to 2023 put the Toyota Corolla first with 6,582 cases, then the Mazda 3 with 5,656, the Hyundai i25 with 2,738 and the Kia Picanto with 2,680.
Elsewhere the pattern follows the local fleet. The Proton Wira leads in Malaysia, followed by the Waja and the Perdana. Indonesian thieves favour Toyota Avanza, Daihatsu Xenia and Suzuki Ertiga people carriers, and in Bangkok it is Toyota cars, the Hilux and the Isuzu D-Max.
How big is car theft overall?
American police logged 810,400 stolen vehicles in 2020, against 724,872 the year before, and losses were put at $7.4 billion. The European Union recorded 505,100 car thefts in 2019. New Zealand had the highest theft rate of any fairly large country in 2020, at 954.0 per 100,000 residents.
Comparisons need care. The UN drugs and crime office warns that countries define and count offences differently, and because the rates are per head of population rather than per vehicle, a country with few cars can look safer than it is. The criminologist Frank E. Hagan argued that vehicles per capita is probably the most important factor of all.
The trade is organised, too. Europol's picture for 2023 puts the busiest vehicle-crime networks in Germany, Poland, Portugal and Serbia. Serbia is where most stolen cars end up in storage and get cloned identities before they are shipped on and resold.
What low-cost steps cut the risk?
Start with the cheap, visible ones. A steering-wheel lock, sometimes called a crook lock or club lock, secures a part the car needs to be driven, and the same goes for devices fitted to a wheel or the brake pedal. A hidden kill switch cutting current to the ignition coil or fuel pump can frustrate or slow a thief, and a window sticker warning of other protections works, at least sometimes, even as a bluff.
Marking helps the aftermath. Microdot tags let individual parts be identified, and Etching the VIN into parts may lower their resale value or make selling them riskier. Alarms are triggered by break-ins, though they do nothing against a relay attack that never touches the glass.
For a keyless car the habits are about the fob. Keep it away from the front door and out of range of the street, because thieves have gone after owners who leave the fob in the hall. A tin box is one reported workaround, and foil or a freezer is the speculative one. Where an insurer asks for a mechanical lock, fit it.
Recovery is a separate line of defence. Police use automatic number plate recognition to scan parked cars, and telematics trackers such as LoJack and OnStar can report a car's location. Some systems add dashcam footage that serves for both recovery and insurance. Recovery rates vary widely with the methods police use and the tracking devices fitted.
Where this goes next
The countermeasure with the best record so far is ultra-wideband ranging. Instead of asking only whether a radio signal arrives, it measures how long the signal takes to travel, and the extra delay a relay introduces makes the key appear distant. In the ADAC testing, the cars that resisted were those fitted with it.
UWB ranging also sits underneath Digital Key 3.0, a specification from the Car Connectivity Consortium.
