How keyless entry works in your car, and why it creates a theft risk

Most UK drivers use keyless entry every day without thinking about how it works. The system is convenient and invisible, but understanding its operation reveals exactly why it is vulnerable to relay attack and what kind of countermeasure can actually stop that attack. This guide explains passive keyless entry technology clearly and connects it to the physical defence that LockCar provides.

Passive keyless entry explained

Passive keyless entry, also called passive entry or simply keyless entry, works through a continuous radio frequency handshake between the vehicle and the key fob. The vehicle broadcasts a low-power signal on a frequency of approximately 125kHz. When the key fob comes within range of this signal, typically about one metre, it receives the broadcast and responds on a higher-frequency channel, usually 433MHz or 868MHz depending on the manufacturer, with an encrypted rolling code. The vehicle’s receiver validates this code and unlocks the doors.

The word passive refers to the fact that the driver does not need to actively press a button on the key fob. Simply being near the vehicle with the key in your pocket or bag is sufficient to trigger the unlock. This is distinct from remote keyless entry, where you press a button on the fob to unlock from a distance. Passive entry is always active and always broadcasting.

Push-button start completes the passive entry sequence. When you press the start button with the key in the vehicle’s proximity, the car performs a second, shorter-range verification to confirm the key is inside the cabin before authorising ignition. This two-stage process is designed to prevent remote start from outside the vehicle, but it relies entirely on the physical presence of the key signal, which relay equipment can replicate.

Why the 125kHz broadcast is the vulnerability

The 125kHz challenge signal that the vehicle broadcasts continuously is the fundamental vulnerability in passive keyless entry. This frequency propagates well through walls, floors, windows, and most building materials. A signal amplifier positioned outside a property can receive the vehicle’s 125kHz broadcast through the wall and re-broadcast it at increased power inside the property, where the key fob picks it up and responds normally. The key fob’s 433MHz response is then relayed back to the vehicle, completing the handshake from a distance of potentially 20 to 50 metres.

Manufacturers have attempted to address this by reducing the broadcast power of the 125kHz signal, adding motion-sensing standby modes to key fobs to reduce broadcast duration, and implementing ultra-wide-band positioning technology in newer models that can more precisely determine the key fob’s physical location. None of these measures eliminates the vulnerability; they increase the difficulty and cost of a successful attack but do not prevent it.

LockCar’s approach is different. Rather than trying to make the keyless entry system more robust, LockCar adds a completely independent authentication requirement at the start circuit level. Even if the relay attack succeeds perfectly, the engine cannot start without the LockCar relay closing. The keyless entry vulnerability becomes irrelevant when the start circuit has its own, separate physical lock.

How LockCar stops this threat

LockCar installs a hardwired relay break in the vehicle start circuit. This break is positioned downstream of the factory immobiliser, the OBD port, and the CAN bus. Even after a successful relay attack or CAN bus injection, the engine will not start because the LockCar relay is open. Closing it requires a second, independent encrypted authentication that relay equipment cannot replicate. LockCar is designed and manufactured in the United Kingdom and installed by mobile engineers at your location.

LockCar recommended products

Top recommendation

LockCar IC3ST, £139

Primary recommendation for this vehicle type

UK-manufactured and professionally fitted. Mobile installation UK-wide from £150 fully fitted. Full installation documentation provided for insurance purposes.

LockCar ONE, £199

24/7 dashcam and immobiliser

The best all-round package for keyless vehicle owners. Physical relay break stops relay attacks. 24/7 dashcam records any approach attempts. No subscription.

LockCar One Plus, £259

4G GPS, live camera, remote immobilisation

For owners who want complete visibility alongside physical protection. Real-time GPS, live camera, and remote immobilise from the app.