How relay attacks work — and how to stop them

Every modern vehicle with keyless entry is, by default, vulnerable to relay attack. The technology that makes entering your car convenient — a passive radio-frequency handshake between the key fob and the car — is the exact technology criminals exploit. Understanding how the attack works is the first step to choosing a defence that actually works. LockCar was designed and manufactured in the UK specifically to defeat relay attacks at their root cause: the ability to start the engine.

What is a relay attack?

A relay attack is a technique in which criminals use electronic equipment to intercept, amplify, and retransmit the radio signal broadcast by your vehicle’s key fob — without physically touching it. Modern keyless entry systems work by having the car constantly broadcast a low-power challenge signal. When the genuine key fob is nearby, it receives the challenge, responds with an encrypted code, and the car unlocks and allows the engine to start.

The problem is that “nearby” is defined in software as approximately one metre. Relay equipment amplifies that range to 10, 20, or even 100 metres. A criminal standing outside your front door can extend the effective reach of your key fob from inside your house — without you knowing, without waking you up, and without triggering any alarm. The car receives a valid signal from what it believes is a legitimate key, and it unlocks exactly as designed.

This is not a hack. The criminals are not breaking any encryption. They are simply extending the physical range of a legitimate, working signal. That distinction is critical, because it means that software patches, encryption upgrades, and firmware updates from manufacturers cannot fix the underlying vulnerability. The only reliable defence is a physical one: preventing the engine from starting even after the doors have been opened.

How the attack happens — step by step

Relay attacks follow a consistent pattern that has been documented by police forces across the UK. Understanding the sequence helps explain why the attack is so fast and why traditional deterrents are ineffective.

Step 1 — Target selection. Criminals identify a target vehicle, usually from the make, model, and parking position. High-value SUVs, Land Rovers, BMWs, Toyotas, and Ford dual-cabs parked on driveways visible from the street are the most commonly targeted. The criminals may surveil an area for several nights before acting.

Step 2 — Two-person relay setup. The attack requires two people with two pieces of equipment: a relay amplifier and a relay receiver (also called a relay extender and a relay transmitter). Prices for this equipment on criminal markets have dropped significantly — devices capable of performing a full relay attack are now available for under £100.

Step 3 — Signal extension. The first criminal stands close to the property — near the front door, a window, or the letterbox — with the amplifier. The amplifier picks up the key fob’s signal from inside the house and boosts it. The second criminal stands next to the target vehicle with the receiver, which retransmits the amplified signal directly to the car.

Step 4 — Vehicle unlock and start. The car’s keyless entry system receives what it believes is a valid signal from the genuine key fob, at the correct range. It unlocks. The second criminal enters the vehicle, presses the start button, and the engine starts — because the car still believes the key is present.

Step 5 — Vehicle removed. The entire process from approach to the vehicle moving takes between 20 and 60 seconds. Once the car is moving, it typically stays running until the engine is switched off. Experienced theft gangs drive stolen vehicles directly to chop shops, re-VIN workshops, or export depots within the same night. Recovery rates for relay-stolen vehicles are low.

Which vehicles are most vulnerable?

Any vehicle fitted with keyless entry — also called passive entry or proximity entry — is technically vulnerable to a relay attack. The system does not need to be a recent model; keyless entry technology has been standard on many vehicles since the mid-2000s. However, some vehicles are targeted far more frequently than others due to their market value, parts demand, and ease of resale.

Land Rover and Range Rover models consistently top UK vehicle theft charts, with 32 thefts per 1,000 registered vehicles recorded across the West Midlands region alone. BMW, Toyota (particularly Hilux and Land Cruiser), Ford Ranger, Lexus, Mercedes, and Jaguar models all feature prominently in national theft statistics. Keyless commercial vehicles including the Ford Transit and Mercedes Sprinter are also targeted by gangs who steal to order for specific clients.

The vulnerability is not limited to high-end vehicles. Any car with a push-button start and a key fob that does not require physical insertion into the ignition is susceptible. This includes a wide range of family hatchbacks, crossovers, and compact SUVs that are becoming increasingly common across all UK household income levels.

UK vehicle theft statistics 2024–2025

Vehicle theft in the UK has risen significantly over the past five years, driven almost entirely by the increase in relay and CAN-bus attacks on keyless vehicles. The West Midlands recorded the highest number of stolen vehicles in the country in 2024, with 5,413 vehicles stolen and recovered — representing 22% of all seized cars in England and Wales. Greater Manchester ranked second with 3,757, followed by South Yorkshire with 2,909.

National Scrap Car data compiled from Freedom of Information requests to UK police forces found that relay and keyless theft now accounts for the majority of vehicle crime in urban areas. The crime rate in the West Midlands stands at 40.8 offences per 1,000 residents — over 17% higher than the national average. Organised crime groups operating across the Midlands have been linked to multiple chop shops discovered during West Midlands Police operations in 2024 and 2025.

The economic impact on UK drivers is significant. Beyond the direct loss of the vehicle, relay theft victims face increased insurance premiums, disruption to work and family life, and in cases where a commercial vehicle is stolen, loss of livelihood. DVLA data suggests that fewer than 40% of relay-stolen vehicles are recovered, and those that are recovered are often found stripped or damaged beyond repair.

Why common defences fail

The market is full of products marketed as relay attack protection. Most provide partial protection at best. Understanding why common defences fall short is essential before investing in a security solution.

Faraday key pouches. Signal-blocking pouches work by preventing the key fob from broadcasting inside the pouch. They are effective when the key is stored inside the pouch — but offer zero protection when the key is on your person. If you have your key in your pocket while loading shopping or briefly leaving the vehicle, the car remains fully vulnerable. Pouches also rely entirely on user compliance: one night of forgetting to use the pouch is all a determined gang needs.

Steering wheel locks. Visible deterrents may cause opportunistic thieves to move on, but they are ineffective against organised relay gangs who specifically target high-value vehicles. An experienced criminal can remove a steering wheel lock in under three minutes. Organised theft gangs often carry angle grinders and specialist tools and are not deterred by physical locks on the steering column.

GPS trackers. Trackers are a recovery tool, not a theft prevention tool. A GPS tracker does not prevent your vehicle from being stolen — it helps police locate it afterwards. By the time a stolen vehicle reaches a chop shop, specialist equipment is used to locate and disable tracking devices before the vehicle is dismantled or re-VINned. Trackers are a useful addition to a comprehensive security solution but should never be the primary line of defence.

Factory immobilisers. Every modern vehicle has a factory-fitted immobiliser that communicates with the key fob via radio signal. This is the system that relay attacks bypass. The OEM immobiliser is part of the keyless entry system — it is not a separate, independent defence. Once the relay equipment extends the key fob signal to the car, the factory immobiliser is satisfied and allows the engine to start. It offers no additional protection against relay attack.

How LockCar stops relay attacks permanently

LockCar devices work on a fundamentally different principle to every other defence listed above. Instead of trying to block or detect the relay signal, LockCar installs a physical relay break in the vehicle’s start circuit — a hardwired interruption that prevents the engine from starting regardless of whether the OEM immobiliser has been satisfied.

The start circuit break is controlled by a second, independent authentication system. Depending on the LockCar model chosen, this authentication is provided by a proximity tag (a small RFID-style token carried separately from the key), a 2.4GHz AES-128-encrypted Wi-Fi signal from the LockCar MCU, or confirmation via the LockCar mobile app. None of these signals can be replicated by a relay amplifier — they operate on different frequencies, with different protocols, and are encrypted end-to-end.

The result is that even if a criminal successfully performs a relay attack and the car unlocks exactly as normal, the engine will not start. There is no error message, no indication of why the car will not start — the vehicle simply does not respond to the start button. This is not a noisy deterrent that might cause a criminal to run; it is an invisible, silent barrier that makes the vehicle technically unstartable without the correct LockCar authentication.

LockCar systems are designed and manufactured in the United Kingdom. Every device is built to withstand the UK’s specific threat environment — including the organised, professional gangs operating across the West Midlands, Greater Manchester, South Yorkshire, and London. The product range covers wired immobilisers for commercial vehicles, standalone app-and-tag systems for personal cars, and full 4G dashcam-plus-immobiliser systems with real-time GPS tracking and live camera feeds for fleet operators and premium vehicle owners.

LockCar anti-theft range

Most popular

LockCar ONE — £199

24/7 dashcam + relay immobiliser

The UK’s best-selling combined dashcam and relay immobiliser. Professional 24/7 parking recording with SD storage plus a hardwired relay break in the start circuit. No monthly subscription. Works on any vehicle with a 12V circuit.

LockCar One Plus — £259

4G remote + GPS + live camera

Full 4G GPS tracking, remote immobilisation, and live camera feed. Monitor and control your vehicle from anywhere in the UK. Ideal for premium cars, Land Rovers, and commercial operators needing real-time visibility.

LockCar IC3ST — £139

App + proximity tag · Standalone

Dual-factor standalone immobiliser. App and encrypted proximity tag unlock. No MCU required. 20A relay, 12/24V. Perfect for single-vehicle households who want a discreet, reliable relay attack defence.

LockCar i226 — £79

Wired + isolated comms + 20A relay

Built for vans, commercial vehicles, and high-current circuits. Isolated MCU-to-immobiliser wiring eliminates signal interception risk. Anti-hijack mode. 20A relay handles Sprinter and Transit starter circuits. From £150 fully fitted.

Relay attack — questions & answers