Keyless Car Theft: Relay Attacks and How to Stop Them

If your car unlocks itself when you walk up to it with the key in your pocket, it can also be unlocked by a thief standing outside your house. Keyless car theft, known as a relay attack, involves criminals using devices to trick the vehicle into thinking the key is close to it, so they can unlock, start and drive the car away¹. The thieves do not need your key in their hands: they only need to be a few metres away from it to capture the signal, even if you think your keys are secure inside your home¹.

The good news is that the defences are simple and mostly free. Police forces across the UK advise keeping keys away from doors and windows, storing keyless fobs in a signal-blocking pouch or faraday bag, and adding physical security such as locks and immobilisers, which are still highly recommended for keyless entry cars². This page explains how the attack works, the signs a car has been targeted, and what to do at every stage, including what happens if the worst occurs and the car is taken.

How a relay attack works, and why the fob is the weak point

Cars with keyless entry unlock automatically when the key comes within a short distance of the car, and this can work from inside a pocket or bag². That convenience is the weakness. The car and the key are constantly asking and answering: the car sends out a signal asking whether the key is nearby, and the key answers. The car cannot tell the difference between a genuine answer from your pocket and an answer relayed through a criminal's equipment.

Keyless car theft or relay theft is when a device is used to fool the car into thinking the key is close by, which unlocks the car and starts the ignition². In practice, one thief stands near your home with a receiver that captures the signal your fob is constantly emitting, while another stands by the car with a transmitter that passes that signal on. The car believes the key is standing beside it and opens. Avon and Somerset Police describe the same method: criminals use devices to trick the vehicle into thinking the key is close to it, so thieves can unlock, start and steal the car¹.

The critical fact for your household is the distance. Thieves only need to be within a few metres of your car key to capture the signal, even if it is inside your home². A fob hanging on a hook in the hallway, left in a coat by the front door or resting on a windowsill is all within range of someone standing on the pavement or in the garden. That is why every police force advising on this point gives the same two-part answer: put distance and walls between the key and the street, and block the signal altogether.

There is a second route in that does not involve your key at all. Many modern vehicles are fitted with engine management diagnostic ports which can unlock and start your vehicle; Sussex Police advise that if yours has this type of port, you should consider fitting a lockable cover². And when selling your car, do not allow a potential buyer to take the keys out of your sight, because your keys may be cloned². Both routes matter as much as the relay attack itself, because a thief who cannot relay your key will look for another way in.

Signs your car may have been targeted

Most relay thefts happen quickly and quietly, but there are warning signs worth knowing, both around the car and around your home. The clearest one costs nothing to check: if your vehicle has wing mirrors that fold in automatically when locked, make sure you lock it properly, because criminal gangs look for vehicles where the wing mirrors are still out, since it is clear to them that the vehicle is unlocked².

A related trick is signal jamming. Electronic devices can be used to jam the electronic signal from your key fob to lock your vehicle, so always manually check your vehicle has locked before walking away². Pull the door handle and try the boot. If the car does not lock when you press the button, someone nearby may be jamming the signal, and you should lock it manually with the physical key if your fob has one, or move the car and try again.

Around the home, look for people loitering near your car or your front door with no obvious reason to be there, particularly in pairs, one near the house and one near the vehicle. Police guidance on catalytic converter theft, a related crime, asks the public to report a vehicle being raised using a car jack in a car park or residential area, and to take photos of suspects or the number plate of their car if it is safe to do so⁵. The same caution applies here: if you see someone jacking up a car or tampering with one, do not confront them. Note what you can and report it.

Gloucestershire Constabulary advises installing external CCTV or digital doorbells, because burglars do not want to be seen and these devices can capture evidence that can be circulated among officers and the public⁶. A dashcam with parking mode can record suspicious activity around your car and provide evidence for prosecution¹. If your camera picks up repeated attempts on your car, or people trying door handles on the drive night after night, treat it as a sign the vehicle has been chosen and step up the measures in the rest of this page. Our pages on home cameras and CCTV and video doorbells cover choosing that equipment.

Where to keep your keys: the police advice and the fire service tension

The police advice is unambiguous. The Police Service of Northern Ireland says to keep your house and car keys safe and away from doors and windows³. A PSNI home safety leaflet adds the burglar's angle: put car keys somewhere they cannot be seen or easily found⁷. A burglar who breaks in wants the car keys first, and the hallway table is the first place anyone looks.

There is a genuine tension here with fire safety advice, and it is worth understanding rather than ignoring. Fire and rescue services across England, Scotland and Wales advise keeping door and window keys where everyone can find them in an emergency: Warwickshire's home escape plan guidance says keys should be located next to the doors and windows⁸, the national Fire Kills campaign says to keep door and window keys in a safe but accessible place near the exit they fit and never leave keys in locks⁹, and Manchester Fire and Rescue Service's bedtime routine says to keep door and window keys where everyone can find them¹⁰. Devon and Somerset Fire and Rescue Service tells tenants to keep door and window keys somewhere accessible, ideally close to the windows and doors, keeping security in mind¹¹.

Notice what that tension actually is. The fire service advice is about the keys to your doors and windows, the ones you need to escape a fire. The police advice about keys away from doors and windows is aimed at car keys and house keys that a thief could reach through a letterbox or broken window, or that a relay device could reach from outside. You can satisfy both: keep your door and window escape keys by the exit they fit, and keep your car keys somewhere entirely different, deeper inside the house, out of sight and away from the outer walls. None of that stops you moving the car fob upstairs or into a drawer away from the window.

If someone in the household needs carers or emergency services to get in, a key safe may be the answer: a lockable box that holds a key, fixed to an outdoor wall with a chosen code set to it, and some key safes are police-approved¹². Our page on key safes explains the approval marks to look for. For everyone else, the rule is simple: car keys live far from the perimeter of the house, and door keys live where you can grab them in the dark.

Signal-blocking pouches and boxes: what they do and how to check yours

A faraday pouch is a small bag lined with material that blocks radio signals. With the fob inside and the pouch sealed, the key's signal cannot reach the street, so a relay device has nothing to capture. The PSNI's Protect Yourself booklet states it plainly: keyless fobs should be kept in a signal-based blocking pouch or faraday bag⁴, and Police Scotland repeats the advice to keep contactless car keys or key fobs in a faraday pouch¹³. Metal boxes and tins work on the same principle, and purpose-made signal-blocking boxes hold several keys.

Test any pouch you buy, because a damaged or poorly made one can leak the signal and give false confidence. The test is easy and uses nothing but your car: put the fob in the sealed pouch, walk to the car, and try the door handle. If the car unlocks, the pouch is not blocking the signal. Repeat the test from the passenger side and with the pouch held close to the car, since a pouch that blocks at ten paces may fail at one. Test again every few months, and after the pouch has been sat on, soaked or creased, because the lining is the part that fails.

One habit makes the pouch work: put the fob in it every single time you come home, not just overnight. The relay attack can happen in the evening while you are in the house as easily as at three in the morning. A pouch only protects the fob while the fob is inside it.

The same certification habit you would apply to any security product applies here. Official guidance on other safety equipment is consistent: check a smoke alarm has either a British Standard kitemark or the Loss Prevention Certification Board symbol¹⁴, and use lightning conductors which have been tested and carry a British Standard kitemark or LPCB sign¹⁵. Apply the same standard to signal-blocking products: choose one that has been tested and certified rather than an unbranded pouch, and retest whatever you buy with the door-handle method above, which is the only test that proves the pouch works with your key and your car.

Switching off keyless entry, and what your handbook is for

Many keyless fobs can be switched so that the keyless function is off but the buttons still lock and unlock the car. With keyless entry disabled, the fob stops broadcasting continuously, and a relay device has nothing to relay: you press a button to unlock, exactly as drivers did for years before keyless entry arrived. The trade-off is convenience, since you have to press the button rather than simply walk up.

How this is done varies by manufacturer, and the pack's official guidance does not give model-by-model instructions, so your vehicle handbook is the place to look. Some cars switch the function by pressing a combination of buttons on the fob, some through the car's settings menu, and some need a dealer to do it. If the handbook does not mention it, ask the dealer or manufacturer directly. The principle from Police Scotland's advice on keeping devices safe applies to your car as much as your accounts: criminals target outdated software with weaker security¹⁶, so keep the car's software updated where the manufacturer provides updates, and ask about updates when the car is serviced.

The same thinking applies when you buy a second-hand car. Sussex Police advise reprogramming your keys if you buy a second-hand car², because a previous owner or a lost spare may still hold a working key. Until that is done, treat the car as one whose keys may exist somewhere you do not know.

Parking, driveways and physical protection that still matters

Signal blocking stops the relay attack, but it does not stop a thief with a cloned key, a jammer or a diagnostic port attack. That is why Sussex Police state that additional physical security such as locks and immobilisers are still highly recommended for keyless entry cars². A visible steering lock or wheel clamp tells a thief that the quick, quiet theft is off, and most will move on.

Stack the layers rather than relying on any one of them: fob in a pouch, keys away from the door, car locked and checked. A steering lock is a layer, not the whole answer, and the same is true of each of the others. The point of layering is that a thief has to defeat every one of them, in sequence, to drive your car away.

Where you park matters as much as what you fit. Avon and Somerset Police advise leaving your vehicle in a well-lit and busier street rather than dark and secluded areas, even if that means an extra five or ten-minute walk¹. Devon and Somerset Fire and Rescue Service, advising on arson, says to park vehicles in a well-lit place and off the road where possible, and always keep your car locked¹⁷. If you have a driveway, use it rather than the street, and lock your garden or drive gates closed and securely locked, keeping gates and fences in good repair, as the PSNI advises for protecting property¹⁸. Good outdoor lighting helps too, and our page on outdoor lights that deter burglars covers the types and where to place them.

One winter habit undoes all of this and is known as frost jacking: leaving the car running unattended on the drive while it de-ices. It is actually illegal to leave your vehicle running unattended while you de-ice it or warm it up in cold weather, and if the vehicle is stolen in those circumstances your insurer will not pay out². Stay with the car, or clear the ice by hand. Our page on leaving your car running while de-icing covers the detail, and storms, snow and ice covers winter preparation generally, including keeping a snow shovel in the car as part of your emergency kit¹⁹.

Finally, think about how you behave in the car itself. Sussex Police advise that in traffic you should drive with the doors locked, and when queuing leave enough space in front of your vehicle to enable you to get out of a tight spot². And if you break down, Milton Keynes Council's breakdown advice is to leave the passenger door unlocked so that you can get back into the vehicle quickly if you feel it necessary²⁰, a reminder that security advice bends to circumstance.

Can a keyless car be tracked once it is stolen?

Once the car has gone, what can actually find it? The answer depends on what the car and its systems carry.

Some modern vehicle alarm and tracker systems have the facility to isolate or shut down fuel systems, bringing the vehicle to a halt². These are fitted systems, usually monitored, and they are the strongest option for a car worth protecting, because they act rather than merely report. If you are considering one, check with your insurer what it requires and recognises, and look for tested products with recognised certification, in the same way official guidance directs you to British Standard kitemarks and LPCB symbols on other safety equipment¹⁴.

Newer cars may carry eCall, the automatic emergency call system. It is worth knowing what it is not: National Highways states that eCall is not a 'black box' and does not monitor your vehicle's movements²¹. eCall exists to summon help after a serious collision, not to trace a stolen car, so do not rely on it for recovery.

The tracking habits that do help are the ones you set up before the theft. The parallel with phones is instructive, because police guidance on smartphone theft describes exactly the steps that make a stolen device traceable and safe: mark your phone as stolen or lost, which can suspend payments, remotely wipe all data, and remotely lock the phone if it is an Android device²². The Metropolitan Police adds to use the keypad lock or biometric authentication so thieves cannot immediately access your phone²³, because some thieves are trying to access your financial information from it rather than just taking the device²². If your car's app or your dashcam's parking mode is linked to an account, that account needs the same protection: strong, unique passwords and two-factor authentication. Police Scotland's guidance on hacked accounts notes that criminals target outdated software with weaker security¹⁶, and the National Cyber Security Centre lists the indicators of a stolen password, including being unable to log in or messages sent from your account that you do not recognise²⁴, and signs of unauthorised activity such as changes to security settings and logins from strange locations or at unusual times²⁵. Check those accounts now, before you need them.

Separately, if someone in your household is at risk because of a medical condition, GPS tracking devices exist that can be worn on the wrist, carried on a keychain or put into shoes, for those at risk of getting lost²⁶. Those are personal safety devices rather than vehicle trackers, but households sometimes ask, and NHS inform in Scotland is the source for that guidance.

What to do if your car is stolen

Work through this in order.

1. Call the police. If you saw the theft happen or the thief is nearby, that is a 999 call. If you come out to an empty space, report it as soon as you discover it. Our page on when to call 999 or 101 about a crime at home explains the difference.
2. Give the details that identify the car: make, model, colour, registration, and anything distinctive. Say that it is keyless and that the keys are still in your possession, because that tells the officer what kind of theft this was.
3. Secure your home. If house keys went with the car, or were in it, your home is now at risk. Change the locks or have them changed, and follow the steps on our page on coming home to a break-in.
4. Check your accounts. If a phone was left in the car, get in touch with your network as soon as possible so they can block it, then report it to the police; cancel any stolen bank cards as soon as possible, using the number on your bank statement or on any cash machine belonging to your bank²².
5. Tell your insurer. Do this promptly; the policy will set the deadline and what it needs.
6. Keep the crime reference number. You will need it for the insurer and for any later correspondence.

Do not chase the car yourself. A stolen car driven by a stranger is dangerous, and recovery is the police's job. What you can usefully do is gather anything that helps them: dashcam parking-mode footage, CCTV from the house or neighbours, and the times you last saw the car. Gloucestershire Constabulary's point about cameras applies here, that the devices can capture evidence that can be circulated among officers and the public⁶.

Reporting the theft: the details that help

The Metropolitan Police guidance on a related vehicle crime sets out the reporting routes plainly: if the crime has already happened then you can report it online or at your local police station⁵. Forces across England, Wales, Scotland and Northern Ireland offer online reporting, and 101 works where you are unsure. If you want prevention advice rather than to report a crime, the PSNI's home safety leaflet suggests asking for your Local Crime Prevention Officer⁷.

When you report, have ready:

• The registration number, make, model and colour of the car
• Where it was parked and when you last saw it
• Whether it is keyless and where the keys were
• Any dashcam or CCTV footage and its time window
• Names of neighbours whose cameras might cover the street

Then contact your insurer with the crime reference number. Be careful about the security you describe: if you told the insurer the car is kept on a locked drive or garaged overnight, or that a steering lock or tracker is fitted, keep that true, because cover can depend on it. Our page on home insurance conditions explains how insurers treat locks, alarms and changes in circumstances. Gloucestershire Constabulary's burglary campaign makes the wider case for layered security: installing a 'WIDE' combination of security devices, covering windows, interior lights, doors and exterior lighting, gives 49 times more protection against burglary compared to no devices being installed⁶. The same layering logic is why this page has not offered a single fix: distance, signal blocking, switched-off keyless entry, physical locks, lighting and cameras each cover what the others cannot.

After the immediate business, take an hour to close the gaps the thief used. If the keys were relayed from a hallway hook, move where they live. If the pouch was never used, start using it. If the car is replaced, reprogramme the keys of the new one if it is second-hand², and check the handbook for the keyless off-switch before the first night it sits on your drive.