How relay attacks steal keyless cars in under 60 seconds – and what actually stops them
No broken windows. No alarm. No key. Your car can be gone before you hear anything. Here is exactly how thieves do it – and the aftermarket protection that genuinely closes the gap.
A car is stolen in England and Wales every 3 to 4 minutes. In 70% of those thefts, no key was used, no window was broken, and no alarm was triggered. The thieves were in and out in under a minute – and they’ll be long gone before you realise your car is missing.
This isn’t science fiction. This is what’s happening on driveways across the UK every single night. And the difficult part is that factory security – the immobiliser your car came with, the keyless entry system the manufacturer is so proud of – was never designed with this method in mind.
In this article, our engineering team explains exactly how relay attacks work, why they are so hard to detect, and what a properly specified aftermarket immobiliser does that the factory system cannot.
What is a relay attack?
A relay attack is a method of car theft that exploits the way keyless entry and keyless start systems work. Your car’s key fob constantly broadcasts a low-power radio signal. When that signal gets close enough to your car, the car recognises it and unlocks – that’s the convenience feature you paid for.
A relay attack amplifies and relays that signal over a much longer distance than it was designed to reach. The thieves don’t need your key. They just need to be near it – even through the walls of your home.
How a relay attack bridges the gap between your key and your car.
The relay device used to do this costs less than £50 on the open market. Two people, a handful of electronics, and less than a minute of your driveway. That’s all it takes.
How relay attacks work – step by step
Here is what a professional car theft team actually does. This is worth understanding in detail, because once you see how simple it is, you’ll understand why key storage habits alone only cover part of the problem.
Surveillance – they’ve already picked your car
Thieves typically scout an area first. They’re looking for high-value keyless vehicles: BMW 3 Series, Range Rovers, Mercedes C-Class, Audi Q5s. These are the most targeted models in the UK. If you drive one, you’re already on a mental list.
Person A approaches your house
One thief walks up to your front door or window – often at 2 or 3am. They carry a relay amplifier device. Your key fob is probably in your hallway, on a hook, or in a bowl near the door. The device picks up the key’s signal through your wall. Some devices can do this from up to 100 metres away.
Person B stands at your car
The second thief stands at your vehicle holding a relay receiver. The two devices communicate with each other, extending your key’s signal across the distance between your house and your car. Your car’s security system cannot tell the difference between a real key and this relayed signal.
The car unlocks. The engine starts.
Your car receives what it believes is a valid key signal. It unlocks. Person B gets in, presses the start button, and the engine starts. No force, no alarms, no glass breaking. The car drives away as if the authorised driver is in it.
Gone in under 60 seconds
From the moment they arrive to the moment the car disappears around the corner: under a minute. In most cases, the owner doesn’t discover the theft until the next morning. By then, the car is typically in a shipping container or stripped for parts.
“They can be in and out in seconds without a single window being smashed or alarm being triggered. I rushed downstairs and confirmed it was indeed my car that had been stolen.” – UK car owner, PistonHeads forum
How common is this in the UK?
Relay attacks went from 14% of UK car thefts in 2019 to more than 58% by 2023, according to ABI data. In 2024, insurers paid out £1.24 billion in vehicle theft claims. The technology has become cheap, accessible, and widespread – and it’s accelerating.
The most targeted vehicles are exactly the ones you’d expect: premium and keyless models that attract thieves because of their resale value and the simplicity of the method.
“I know certain cars are hot with thieves. You visit Birmingham or London, park up, and you wonder if it’ll still be there when you come back.”
– UK driver, Evoque Owners Club
One owner calculated after his theft that spending £2,700 on security up front would have been cheaper than the years of increased premiums that followed the claim.
– UK car owner, automotive forum
The financial fallout goes well beyond the value of the car. Insurance premiums increase for years after a claim. Your no-claims bonus is gone. And with only 40% of stolen vehicles ever recovered – often damaged or stripped – the emotional cost is significant too.
The device that costs £50 and steals £50,000 cars.
What common precautions do and don’t cover
Most of the standard advice is worth following. It simply operates at a different level to the attack, so it is best understood as one part of a layered approach rather than a complete answer.
Faraday pouches and signal-blocking boxes
These do exactly what they claim – as long as the key is inside them, every time. In practice, keys end up on a hook in the hallway, on a kitchen counter, or in a coat pocket by the door, and in those moments the fob is broadcasting a live signal. Worth using, but only as consistently as you can manage it.
Steering wheel locks
A genuine visual deterrent, and they add time to any attempt. They are a mechanical measure on the cabin side of the problem, so they work best alongside something that also addresses the engine start.
Your factory immobiliser
The immobiliser your car came with was designed to prevent starting without a valid key. A relay attack presents the system with what looks like a valid key, so the factory system does what it was built to do. That is why an independent second layer, added after the key is validated, makes such a difference.
Dashcams and trackers
Extremely useful for evidence and recovery, and worth having. Recovery, though, happens after the fact – prevention is a separate job.
The core point: all of the above operate at the signal, access, or recovery level. A relay attack has already satisfied signal security before those measures come into play. What closes the gap is a layer that acts after the key is validated – at the point where the engine is actually authorised to start.
The layer that actually stops a relay attack
An aftermarket immobiliser that operates independently of the car’s key system.
Here’s the logic: a relay attack makes your car think your key is present. Your car responds by unlocking and allowing the engine to start. If the attacker then presses the start button – the engine starts. Job done.
Unless there is a second layer of protection that the relay attack knows nothing about, and that only recognises you. A LockCar system holds the vehicle immobilised until it detects your proximity tag, your smartwatch, or your app authorisation. The relayed key signal is irrelevant to it, because it was never listening for the key in the first place.
A thief can relay your key signal perfectly. They cannot produce the second authorisation. The engine simply won’t start.
“3 days after buying a Golf R, I was broken into. I had an immobiliser fitted a couple of days later. 3 weeks later they came back – different blokes – and broke in again. But they couldn’t start it. That was the moment I trusted it.” – UK car owner, automotive forum
Choosing the right immobilisation architecture
Not every vehicle should be immobilised the same way. This is where our engineering team spends most of its time, and it is the reason we build across every architecture rather than fitting one method to every car that comes through the door.
LockCar designs and manufactures CAN bus, LIN bus, ADC and relay systems in-house, with engineers who have each spent more than twenty years working on vehicle networks and ECU diagnostics. We specify the architecture to the platform, the parking situation, and how you actually use the car – and on many installations we layer more than one.
| Architecture | How it immobilises | Where we specify it |
|---|---|---|
| CAN bus | Integrates with the vehicle’s primary communication network and withholds start authorisation until you are recognised. | Modern platforms where deep integration and full app intelligence are wanted. Our strongest area, and the work our ECU experience matters most for. |
| LIN bus | Uses the lower-speed sub-network that handles doors, mirrors, lighting and comfort modules. | Vehicles where the cleanest, least intrusive integration point sits off the main CAN. |
| ADC (analogue) | Monitors and controls discrete analogue inputs rather than digital network traffic. | Older platforms, commercial vehicles, and mixed fleets where discrete control is the better fit. |
| Relay | A 20A relay physically interrupts an engine circuit, with no presence on any network. | Anywhere a hard physical cut is the right answer – nothing for a remote attack to communicate with. |
| Combined | Bus integration for intelligence and app control, plus a physical relay cut for hard immobilisation. | High-value vehicles and owners who want layered protection. Because we design every part, the layers work together. |
CAN bus integration is the most demanding work in aftermarket vehicle security, and it is where our experience counts for the most: we map the platform before choosing an integration point, verify diagnostic behaviour after fitting, and test the installation before the car goes back to you. That is what makes us the number one alternative for CAN bus immobilisation in the UK.
You can read more about how each method works in our detailed guide: CAN bus, LIN bus, ADC and relay – how each method works →
What to buy – and what to look for
At LockCar, we manufacture every product ourselves – from the PCB to the firmware to the app. That means we know exactly what is inside each device, and we stand behind every installation. Here are the systems we recommend for different situations.
For individual car owners – the IC3ST
LockCar IC3ST – Standalone Immobiliser
App-controlled. Proximity tag (1.5m). Works on cars, vans, EVs, HGVs, motorhomes. No MCU required – completely standalone, and specified with the integration method that suits your vehicle. Just walk up and it knows it’s you.
View the IC3ST → Get a free installation quoteFrom £300 fitted
For premium vehicles or wider detection range – the IS357
The ↗ LockCar IS357 (£149) adds a 5-metre proximity tag range, Bluetooth, and support for smartwatch and smart ring as a trust device. Walk up wearing your watch – the car is already disarmed. No codes, no buttons.
For maximum remote control – the ONE Plus
The ↗ LockCar ONE Plus (£199) adds 4G remote access, a live camera feed, GPS+GLONASS tracking, and automatic night-time immobilisation. At 11pm (or whatever time you set), your car locks itself down – automatically, without touching the app. Fleet-grade capability at a price built for individual owners.
The IC3ST – standalone, app-controlled, and fitted in under an hour at your door.
The installation advantage
One of the most common questions people have about aftermarket security is about the installer. Who is this person? Are they qualified? What happens if something goes wrong?
At LockCar there is no separation between the manufacturer and the installer. The engineers who designed and built your device are the same team that fits it at your door – and every engineer working under our name has been through our vetting and certification: proven auto-electrical background, verified experience on modern vehicle networks, training on our own hardware across CAN bus, LIN bus, ADC and relay, and documented installations audited against our standard. Nobody touches a customer’s car until they are signed off.
That means one team, one standard, and one point of accountability from the circuit board to the driveway.
“You’re not buying a product and then finding someone to fit it. We do everything – one team, one standard, one call if you ever need us.” – The LockCar Engineering Team
The bottom line
Relay attacks are not a fringe concern. They’re the dominant method of modern car theft in the UK, and they’re growing. Factory security was never built to stop them, and key storage habits only help when they are followed perfectly, every single time.
Reliable protection comes from an aftermarket immobiliser that operates independently of your car’s key system, specified correctly for your vehicle. It doesn’t matter if a thief relays your key signal perfectly – without your authorisation, the engine won’t start.
If you drive a vehicle worth more than £15,000 – especially a BMW, Range Rover, Mercedes, or any other commonly targeted model – this is not optional protection any more. It’s the minimum standard.
Ready to protect your vehicle? Browse the full LockCar immobiliser range – or contact our team on WhatsApp for a free recommendation and installation quote. We come to you.