A Chicago driver walked out of her house this week to a stretch of empty curb where her car had been. No broken glass, no scattered trim clips, no ignition lock hanging out of the steering column. Police told her what happened: someone stood near her house, captured the signal her key fob was quietly broadcasting from inside, and used it to open and drive off her car.
That description gets shortened to “they cloned my key” a lot, and it’s worth pulling apart, because two very different attacks get jammed under that phrase and only one of them involves copying anything.
What a relay attack actually does
Passive keyless entry doesn’t work by the fob shouting at the car. It works the other way around. Touch the door handle and the vehicle wakes up a low-frequency antenna — around 125 kHz, deliberately short-range — and sends out a challenge. Your fob hears it, wakes up, and answers on a UHF band, usually 315 MHz in North America or 433 MHz in Europe. The car checks the cryptographic response, and if it’s valid, the doors unlock and the immobilizer stands down.
The security model rests entirely on that LF challenge being weak enough that only a fob within a meter or two can hear it. Distance is the authentication. Everything else — rolling codes, AES, secure elements — is doing its job perfectly while the car makes a completely wrong assumption about where you’re standing.
Related Articles
- DoorDash Will Deliver Your Car Battery in Under an Hour — And AutoZone Wasn’t Invited
- Rivian Kills Alexa: What R1 Owners Lose and What Connect+ Really Costs
A relay pair defeats that by rebroadcasting the LF challenge. One device sits near the fob, the other near the car, and the link between them stretches a two-meter conversation across a house. Nothing gets decrypted. Nothing gets recorded. The fob answers honestly, and the car believes an honest answer.
Researchers at ETH Zurich published the definitive teardown of this back in 2011, and the findings still explain what happened on that Chicago street. Their relays were independent of the modulation, protocol, or presence of strong authentication and encryption, they worked across 10 car models from 8 manufacturers, and — the part that matters most — relaying the signal in one direction only, from car to key, was enough, at tested distances up to 50 meters through walls, with the fob excitable from as far as 8 meters. Fifteen years later, that’s still the attack. The equipment just got cheaper.
The part where it isn’t a relay attack
Here’s the wrinkle in the “replicated onto a new key” version of the story. A relay attack produces no key. It produces one drive-away. Once the engine is running the car will keep running until it’s out of fuel or charge, because the immobilizer only checks at start. Shut it off in a garage three suburbs over and the thief needs the relay all over again — or a way to enroll a new fob.
That second step is a separate operation, and it happens on the wire, not over the air. The best-documented example is the CAN injection attack picked apart by Ken Tindell of Canis Automotive Labs after a friend’s Toyota was stolen. Thieves pulled the front bumper and headlight to reach the CAN bus, then injected frames impersonating the smart-key ECU using hardware hidden inside a Bluetooth speaker. Tindell’s proposed fix is the boring, correct one: a zero-trust approach to CAN, where ECUs demand cryptographic proof that messages are genuine, using a hardware security module. KentindellKentindell
The practical difference matters for owners and for the shop that ends up with the car. A relay theft leaves nothing. A programming or injection attack usually leaves broken tabs, a disturbed headlight, a scarred OBD surround. If your recovered car has damaged front-end wiring, that isn’t collision damage a thief caused — that’s the entry method.
Roughly one car in seven resists
Germany’s ADAC has been running this test continuously since 2016, and it’s the only large public dataset on which cars actually hold up. As of its January update, the club has now run its range extenders against more than 800 keyless vehicles, and only about 15 percent couldn’t be fooled. adac
What separates the 15 percent is ultra-wideband. Instead of inferring proximity from signal strength, UWB measures time of flight — it clocks how long the radio pulse actually takes to make the trip. You can amplify a signal, but you can’t make it arrive earlier than physics allows, so the relay’s added latency exposes it. Jaguar Land Rover fielded it first, in 2018, and since 2019 it has spread across Audi, Cupra, Seat, Škoda and Volkswagen models, with first examples from BMW, Genesis, GWM, Hyundai, Kia, Mercedes and Suzuki. The same ranging approach underpins the phone-as-key standard: the Car Connectivity Consortium built Digital Key Release 3.0 around UWB distance measurement combined with Bluetooth Low Energy, with keys held in a secure element. adacCarconnectivity
The other countermeasure is a motion sensor in the fob that puts the radio to sleep when the key sits still. It’s cheap and it helps overnight, but ADAC is blunt about the gap: a car is still stealable during the window before the fob sleeps, including immediately after parking or if thieves simply follow the owner on foot. The club wants that timeout capped at five minutes. adac
Nobody’s regulating the radio
The federal standard that governs this is FMVSS 114, and it’s more interesting than you’d expect. It already defines a key as a physical device or an electronic code which, when inserted into the starting system by physical or electronic means, enables the operator to activate the engine — so passive entry is covered in principle. What the standard actually demands is that the car not start with the key removed, and that a manufacturer offer at least 1,000 unique key combinations per vehicle type. That’s the federal floor. A thousand. There is no requirement addressing broadcast range, relay resistance, or distance verification, and the section hasn’t been substantively touched since 2010. ecfrecfr
State law isn’t aimed at the hardware either. Illinois handles vehicle theft under 625 ILCS 5/4-103, which makes possessing a vehicle you know to be stolen a Class 2 felony — but the statute’s machinery is built around VIN plates, mylar stickers, rosette rivets and falsified identification numbers. It’s a law written for chop shops. Possessing a pair of range extenders isn’t in it.
The insurance problem you don’t see coming
A theft with no forced entry creates a specific headache. ADAC flags it directly: when a keyless car is recovered with no break-in or other theft traces, owners can run into problems with claim settlement or even suspicion of staging the theft for insurance fraud. adac
Related Articles
- ZT Automotive Buys Charlotte McLaren and Rolls-Royce Stores: What Owners Need to Know
- Rivian’s R2 Launch Quarter Looks Great Until You Read The Segments
Theft is a comprehensive-coverage loss, not collision, so if you carry liability only, the car is simply gone. If you do file, build the record early — police report number, the fact that both fobs are still in your possession, any doorbell or garage footage, and a note that the vehicle is keyless-equipped. Handing an adjuster an explanation for the missing pry marks is better than making them ask.
One Chicago-specific detail worth knowing: the City Council amended the impound ordinance in April 2022 to eliminate towing and storage fees assessed on impounded stolen vehicles. If your recovered car turns up at a pound, you should not be paying accrued storage on it. City of Chicago
What the theft numbers do and don’t tell you
Nationally, this is happening against a backdrop of falling theft. NICB counted 659,880 vehicles stolen in 2025, a 23 percent drop and the lowest figure in decades, though Illinois still ranked third by volume with 28,327, and the Chicago metro third among metro areas with 24,299. nicbnicb
Read that top-ten stolen list carefully, though. The Elantra, Accord and Sonata lead it — cars taken by methods that have nothing to do with radio relays. Theft data comes from NCIC reports, which record that a vehicle was stolen, not how. Relay theft has no category of its own in any of it. That’s a genuine blind spot, and it means the only real visibility into which cars are vulnerable comes from a German motoring club with a range extender and a parking lot. nicb
What to do about it tonight
Start with the owner’s manual. ADAC’s first recommendation is to check whether passive entry can be switched off at all — on some cars it’s two presses of the lock button, on others it’s buried in the center-screen menu, on some it requires a dealer visit, and on a few it can’t be disabled. You lose the walk-up convenience and keep the button. adac
If you’re using a Faraday pouch, tin, or wrapped foil, test it rather than trusting it. ADAC’s method is simple and I’d run it before relying on anything: seal the fob, walk to within a meter of the driver’s door, and try the handle. If the car opens, the shielding doesn’t work. Skip the refrigerator trick — the seal may leak RF, the cold saps the battery, and moisture is unkind to the electronics. Otherwise, keep fobs away from exterior walls, front doors and windows, and remember the spare in the kitchen drawer is broadcasting too. adacadac
Be skeptical of aftermarket “anti-relay” boxes that interrupt a start circuit. ADAC notes the common failure: many of them are armed with their own supplementary keyless remote, which can be defeated exactly the same way as the factory system. A device you physically operate — a hidden switch, a wheel lock, an OBD port lock — doesn’t have that problem. adac
And if you’re shopping: ask whether the fob uses UWB or a motion sensor. It’s a genuine security spec, it varies by trim and model year within the same brand, and roughly six out of seven keyless cars still don’t have it. Nobody puts it on the window sticker. That’s the whole problem.