What is a relay attack in car theft?

By Paul Cumbers · Updated 12 June 2026

A relay attack is a method of stealing a keyless-entry car by tricking it into thinking its smart key is right beside it when the key is actually inside your house. Two thieves work together with a pair of relay devices: one stands near your front door to pick up the faint signal your key fob is constantly broadcasting, the other stands at the car and re-transmits that signal to the door handle and start button. The car unlocks, the push-start works, and the vehicle is driven away - all without touching, copying or breaking the key.

It is fast, silent and leaves no broken glass, which is why it has become a favourite technique against modern cars in South Africa. The whole job can take well under a minute, and because nothing is forced, an owner often only realises what happened when the car is simply gone the next morning.

Compare South Africa’s leading trackers & dashcams in one short form.

Get my quotes

How a relay attack actually works, step by step

Keyless-entry keys broadcast a short-range signal so the car can sense the key approaching and unlock or start on demand. In a relay attack, one device acts as a receiver held close to where the key sits - against a window, a front door or a wall - and captures that signal. A second device, held at the car, acts as a transmitter and relays the captured signal to the vehicle as if the key were in the driver's hand.

The car cannot tell the difference between the real key two metres away and a relayed copy of its signal, so it unlocks and authorises a start. Once the engine is running the thieves drive off; many keyless cars will keep running even once they are out of range of the original key, so the car never needs the real fob again until it is switched off.

Why keyless cars are the target

Older cars with a physical key that turns in the ignition are immune to this particular trick, because there is no constant wireless signal to relay. Relay theft specifically exploits passive keyless entry and push-button start - the convenience feature where you never take the key out of your pocket. The more seamless that convenience, the larger the window a relay device has to exploit.

That is why the cars taken this way tend to be newer, higher-specification models with keyless systems as standard. The technique does not care about the badge; it cares about whether the car listens for a key signal it can be fooled into hearing.

How long it takes and why it is so quiet

Because there is no forced entry, a relay attack produces none of the usual signs of a break-in - no smashed window, no jimmied lock, no alarm triggered by impact. The relay handshake takes seconds, and a practised pair can be in and away in under a minute, often in the dead of night outside a quiet suburban home.

That silence is the dangerous part. With a smash-and-grab there is at least a chance a neighbour hears something; with a relay attack the first sign of trouble is usually an empty parking spot, by which point the car is already on a main road heading out of the area.

Which cars are most at risk in South Africa

Any vehicle with passive keyless entry and push-button start is a potential relay target, from premium German SUVs to the growing number of mid-market models that now ship with keyless convenience. As keyless systems have spread down the price range, so has the pool of vulnerable cars.

Some manufacturers have added motion-sensing fobs that go to sleep when the key is still, which helps, but coverage is patchy and many owners do not know whether their fob has the feature. The safest assumption is that if your car unlocks as you walk up to it without pressing a button, it can in principle be relay-attacked.

What a relay attack cannot defeat

A relay attack gets a thief into the car and lets them drive it, but it does nothing about what happens next. A separately fitted, monitored stolen-vehicle recovery unit does not rely on the key at all - it watches the car's movement and signal, and a sudden unauthorised drive at 02:00 is exactly the pattern a good system flags to a control room.

This is the key point for an owner: you may not be able to stop a determined relay crew getting the car moving, but you can make sure the car cannot disappear. Recovery-grade tracking is the layer that turns a stolen keyless car into a recovered one.

Layering your defences

The sensible response to relay theft is not one gadget but a stack of them: block the signal at the source with a Faraday pouch for the fob, add a physical or electronic barrier such as a hidden immobiliser or a steering lock that buys time, and fit a monitored tracker so that if the first two layers are beaten the car is still recoverable.

No single layer is perfect, but each one raises the effort and risk for the thief. A relay crew looking for an easy, silent minute will usually move on to a softer target rather than fight through a fob in a Faraday pouch, an immobiliser that will not let the car start, and a tracker that is already alerting a control room.

How relay theft keeps evolving

Relay theft is an arms race. As awareness has grown, some manufacturers have moved to ultra-wideband keys and motion-sensing fobs that measure distance more precisely or stop broadcasting when still, which makes a simple relay harder. Thieves, in turn, refine their devices and range, so the threat shifts rather than disappears.

For an owner this means two things: do not assume a newer car is automatically safe, and do not assume an older keyless car is hopelessly exposed. Check what your specific fob does, block its signal regardless, and keep the recovery layer in place - because whatever the manufacturers add next, a monitored tracker still works on every car.

What relay theft means for an insurance claim

Because a relay attack leaves no forced entry, an insurer may question how the car was taken, and a claim can hinge on showing the vehicle was reasonably secured. Keeping proof of an approved, fitted tracker and any anti-theft measures on record helps demonstrate that you took the risk seriously.

This is another reason the recovery-grade tracker matters beyond recovery itself: it is the device insurers recognise, it usually earns a premium discount, and its data record of the unauthorised movement can support your account of events after a relay theft.

Spotting that a relay theft was attempted

Relay attempts are quiet, but there can be subtle signs: a car found unlocked when you are sure you locked it, interior lights or systems behaving as though the car was woken overnight, or neighbours' cameras catching two people lingering by the house and the car. None of these is proof, but together they suggest your fob signal was reached.

If you notice them, tighten up immediately - pouch the fob and spare, review where you park, and confirm your tracker is live - because a property that has been scouted once is often revisited.

Higher-risk times and places

Relay theft favours quiet, private conditions: a car parked on a driveway or street close to where the keys sit indoors, overnight when the household is asleep, in suburbs where homes back onto easy escape routes. The closer the fob is to an exterior wall or window, the easier the relay.

Knowing this lets you adjust: keep keys deep inside the home rather than by the front door, park in a garage where possible, and treat any car that unlocks as you approach without a button press as a relay candidate that needs the full set of defences.