Threat · keyless entry
Two boxes. Twenty seconds. No broken glass.
The relay attack is the most common electronic car theft in Britain, and the most misunderstood. It does not hack anything, it does not break any encryption, and there is nothing wrong with your car. It simply moves a radio signal about fifteen metres.
What happens on your driveway
Your keyless entry key is not asleep in the bowl by the door. It is awake, listening, and answering. The car sends out a low-frequency invitation every second or so; when the key hears it, the key replies on a higher frequency with a cryptographically valid response. The car checks it and unlocks. This exchange is deliberately short-range — a metre or two — because the range is the security. If the key can answer, the manufacturer assumes the owner is standing there.
A relay attack breaks that assumption without touching the cryptography. Two people work together:
- The first walks up to your house with an amplifier and holds it near the front door, a letterbox, a hallway window — wherever your keys usually live. It picks up the car's invitation, which their partner has just triggered by touching the door handle, and pushes it through to the second unit over a radio link.
- The second person, standing by the car, replays that invitation. Your key, sitting on the hall table, hears what it believes is the car and answers correctly.
- The answer travels back down the same link. The car receives a perfect, genuine, correctly encrypted response. The doors unlock and the start button works.
The whole thing takes between fifteen and sixty seconds, most of which is walking. There is no alarm because nothing was forced. There is no damage because nothing was broken. Neighbours see two men getting into a car and driving off, which is exactly what it looks like.
Once the engine is running, the car will not shut down just because the key has gone out of range — that behaviour exists so you do not stall on a motorway if a key battery dies. Most cars give a warning on the dashboard and keep driving. The thief simply never switches off until the car is somewhere safe, where a fresh key can be programmed through the OBD port.
What the equipment actually is
There is no point being coy: this hardware is sold openly, marketed to locksmiths and vehicle recovery firms, and costs a fraction of the value of a single stolen car. It is a pair of RF repeaters in cases small enough to fit inside a rucksack or a jacket. Operating range between the two units is typically a hundred metres or more, which is why the thief on the doorstep and the thief at the car do not need to be within sight of each other.
There is nothing to learn and nothing to hack. It is a two-button device. This is the crucial point about the entire category of keyless theft: the skill barrier collapsed years ago. The people using this equipment are not engineers.
Why the car has no way to notice
From the car's perspective every single security check passed. The challenge was correct, the response was correct, the rolling code advanced properly, the transponder identity matched. Nothing anomalous happened at all. There is no log entry to find afterwards, and the insurer's assessor will find a car that was, technically, opened with its own key. That is why some claims turn awkward.
Manufacturers have responded in two ways. Motion-sensitive keys go dormant after a few minutes lying still, which defeats a night-time attack on a key that has been on the hall table since evening — but not an attack in a car park while you are shopping, with the key moving in your pocket. Ultra-wideband ranging, on newer premium models, measures the true flight time of the signal and rejects a relayed one; it is effective, and it is only on a small fraction of the cars on British roads.
Signs your car is being surveyed
- Your car's indicators flash or the mirrors fold at a time when nobody touched it — someone triggered the handle and left.
- A vehicle parked near your house repeatedly across several evenings, particularly with someone sitting in it.
- Neighbours reporting people walking along the pavement holding a phone-sized object close to front doors.
- A small plastic marker, cable tie or chalk mark on your wheel arch or kerb. Target marking still happens.
- Doorbell camera footage of a two-person pass in front of your house at 2am. Check it. Most people never look.
What actually stops a relay attack
There are exactly three interventions that work, and one of them is free.
Break the radio path
A signal-blocking pouch, a metal tin, or simply keeping keys away from external walls and doors. Free to nearly free, and genuinely effective — while the key is in there. The problem is human: the key goes in the pouch on Monday and sits on the kitchen worktop by Thursday. Test the pouch monthly by locking your key inside it and trying to open the car.
Turn the key off
Many keys can be put into a sleep mode with a button sequence, and most manuals hide the instructions in a chapter nobody reads. Worth ten minutes with the handbook.
Add a check the key cannot pass
This is the only one that keeps working when the human element fails. A second immobiliser that authorises against something other than the key — a paired phone over encrypted Bluetooth, a proximity tag, or a PIN entered on the car's own buttons — is entirely outside the relay attack's reach. The relay box amplifies a key signal. If the second check never listens to the key, there is nothing to amplify.
With LockCar CAN-IMMO, the relayed key still gets past the factory immobiliser exactly as before. It then meets a second question it has no answer to, and the engine does not start. The thief is standing in an unlocked car that will not move, with no idea why, and no component to look for. How the technology works →
Four things people believe that are not true
"Relay theft only affects expensive cars."
It affects keyless cars. That includes a great many mainstream family cars, and hybrids have moved sharply up the theft charts because their components sell well. Value is not the filter; convenience is.
"My car is old, so I am fine."
You are safe from relay attacks and exposed to OBD key programming instead, which is the older, quieter method that never went away. More on that here →
"The tracker will get it back."
Sometimes. Recovery rates published from national data suggest roughly two thirds of stolen vehicles are never returned. Organised teams park a stolen car in a quiet street for a day or two to see whether anyone comes for it, and check it for trackers before it moves anywhere important.
"Wrapping the key in foil is the same as a pouch."
Sometimes it works, often it does not, and you will not know which until it matters. Foil has gaps and creases. Buy a proper pouch and test it.
Questions we get asked
How far away can a relay attack work from?
The amplifier near your house needs to be within roughly a few metres of the key, so typically at your front door, a window or a wall the keys hang beside. The link between the two thieves' units can span a hundred metres or more, so the person at your door and the person at your car do not need to be near each other.
Will my alarm go off during a relay theft?
No. The car was opened with what it believes is its own key, so the alarm disarms normally. There is nothing for it to react to. This is exactly why relay theft is so quiet.
Does a Faraday pouch stop every kind of keyless theft?
It stops relay attacks. It does not stop key cloning, CAN injection or someone taking the physical key. It is a useful habit and a poor substitute for an immobiliser.
Can my car be relayed while I am driving it?
No. The attack targets a parked, locked car and a key that is elsewhere. The relevant risk while driving is car-jacking, which is why systems with an anti-hijack mode exist.
Would a second immobiliser stop the thief getting inside the car?
No, and it is not meant to. They can still open the doors with a relayed signal. What they cannot do is drive it away, which is the part that costs you the car.
Relay-proof your car in one appointment
LockCar CAN-IMMO adds a second authorisation that has no radio link to your key at all — which means a relay box has nothing to work with.
Get a quote for your carLockCar · 06 modules · built in the UK
The full LockCar range
Visit the shop →CAN-IMMO is one module in a wider system. LockCar also builds trackers, 4G cameras, alarms, apps and fleet monitoring — and we fit and support all of them.
Category pages open on lockcar.co.uk — the manufacturer's shop
Autowatch and Ghost are trademarks of Autowatch Ltd. IGLA is a trademark of AUTHOR Ltd. LockCar is a trademark of its manufacturer. 5StarWin is not affiliated with, endorsed by or acting on behalf of Autowatch or AUTHOR. Comparisons on this page are based on publicly published manufacturer and installer information available in August 2026 and on our own fitting experience; specifications, approvals and prices change, so please confirm current details with each supplier before you decide. Nothing here is insurance advice — always tell your insurer about any security device fitted to your vehicle.