A relay attack on keyless entry passes messages between the car and the owner's key, which may be far away, so the car believes the key is close. The messages are not altered, so encryption does not stop it. Ultra-wideband ranging helps because it measures distance, not just whether a signal arrives.
How the attack works
The method is also called the two thief attack. One person stands near the car. The other stands near the key, perhaps inside a house. A device near the car picks up its wake up signal and relays it, and a second device near the key relays the reply back. The car sees a valid answer and unlocks.
The key point from the reference page is that the relay passes messages along unchanged. Researchers testing ten vehicles from eight manufacturers found their relays were independent of the modulation, protocol, or presence of strong authentication and encryption. A cipher protects content, but here the attacker does not need to read or change the content.
Why distance is the real control
The weakness is that the car decides the key is near because it can hear it. Hearing a signal is not the same as the key being close. A relay adds delay, but ordinary radio checks do not measure it precisely.
Ultra-wideband ranging measures the signal's time of flight. The delay a relay adds makes the key look farther away than it is, so the car can refuse. The Car Connectivity Consortium's Digital Key 3.0 specification uses UWB ranging.
What testing found
A 2024 test by the German ADAC covered 698 vehicles. The reference page says 629 could be unlocked and started with relay equipment, and the vehicles that resisted were those with UWB. Treat these figures as reported by a secondary source and check the ADAC publication if you plan to cite them.
What owners can do
The source material does not cover these, so they are general practice rather than findings.
- Ask the dealer whether your model uses UWB or only low frequency and radio signals.
- Store keys away from entrances and outside walls.
- Check whether your key fob can be put into a sleep mode, and read the manual.
- Park in a secured place where possible, and use a visible mechanical deterrent.
What manufacturers should do
Treat key distance as a security property in the threat analysis, not just a convenience feature. Include relay in the attack paths for any feature that lets a person start or unlock a vehicle by proximity, and plan hardware that can measure distance.
Why this keeps coming up
Relay attacks matter beyond cars. Any system that treats radio reachability as proof of presence has the same flaw. Buildings, payment cards and phones have variants. The lesson for designers is to ask what the control really proves, and whether an attacker can satisfy it without being near.
Quick check
Does stronger encryption stop a relay attack?
No. The relay does not break or alter the messages, so encryption and authentication alone do not defeat it.
Sources
Last reviewed: 19 October 2026.
