A keyless car can be stolen in under a minute. Two people, a pair of cheap radio amplifiers, and a fob sitting on a hallway table inside the house. That is enough. No broken glass. No alarm. No sound.
Most keyless cars remain vulnerable
The vulnerability runs across the global market. Germany’s largest auto club, ADAC, runs ongoing tests of keyless models against relay attacks. The rolling series has now covered more than 800 vehicles, with around 15% adequately protected against the method. The remaining 85% can be opened and driven away with cheap signal-extension equipment, according to ADAC.
Police and insurance data tracks the resulting theft pattern. The Netherlands’ vehicle crime bureau, Stichting VbV, found keyless entry on 59% of passenger cars stolen across the country in 2025. A February 2026 analysis from Mercury Insurance, drawing on National Insurance Crime Bureau (NICB) data, tied the slower decline in US high-theft states such as California to keyless entry exploitation and OBD hacks.
Thieves work in pairs, use radio gear that costs little online, and drive away in under a minute. Mass-market models lead the stolen-vehicle counts. Higher-value cars, including BMW G-Series models, draw separate attention from organized theft rings for resale and parts value.
Clemens Muehlbacher, CEO of xAutomotive, told Help Net Security that access methods on current vehicles have multiplied. “One issue is that the attack surface increases by introducing multiple ways in which vehicles can be accessed nowadays,” he said. “While it was solely the key fob in the past, there are now options to open the car via an online connection, as well as NFC keys. Each method introduces new vulnerabilities, of course,” he added.
How relay attacks work
A relay attack targets the radio signal that a keyless fob sends out at all times. The fob broadcasts a short-range code that tells the car the owner stands nearby.
Two people run the theft. One stands close to the house or the owner and holds a device that detects and boosts the fob signal, including a signal from a fob resting on a hallway table or sitting in a pocket. That person relays the boosted signal to a second device held next to the car. The car reads the relayed signal as the genuine key and unlocks. The same signal lets the thief press the start button and drive off. A relay attack runs in under 30 seconds and leaves the car with no broken glass and no damaged locks.
The hardware market makes the attack accessible. “What surprises us most is how easy it is to purchase systems that can copy keys or hardware for relay attacks,” Muehlbacher said.
Theft through the diagnostic port
Some thefts route through the car’s on-board diagnostics port, the OBD-II socket a mechanic uses for service. A thief gains entry to the cabin, plugs a programming tool into the port, and writes a new key that the car accepts.
Key cloning follows a similar path. A diagnostic tool reads the data exchange between the fob and the car, then programs a blank key to match. Each method hands the thief a working key and a car that starts on command.
Factory alarms stay quiet during these attacks
A relay attack copies the behavior of the genuine key. The car’s computer reads the unlock and start as owner actions and keeps the factory alarm silent. A steering wheel lock and other visible deterrents slow a thief who works by hand. They add little against an attack that runs through the car’s own electronics. Signal-based theft needs only seconds and makes no sound.
Muehlbacher said carmakers know the limit. “OEMs are well aware of this, and some even make you sign an additional waiver as part of your purchase contract when ordering a car with the keyless-go option,” he said.
Layered defenses for keyless vehicles
Muehlbacher said the threat extends past pure electronics. “In the luxury segment in particular, we also see a combination of social engineering and technical tools being used to steal cars. Sometimes, keys are simply stolen as they are usually stored somewhere easily accessible inside the house,” he said.
Drivers lower their exposure by combining several measures.
A signal-blocking pouch, often called a Faraday pouch, holds the key fob and stops the fob signal from reaching a relay device. Storing keys away from doors and windows adds a second barrier and keeps the signal deeper inside the home.
An OBD port lock covers the diagnostic socket and slows a thief who wants to program a new key.
A software immobilizer adds an authentication step that a relay device and a cloned key cannot satisfy. One example for BMW G-Series cars with automatic transmission, xProtect Immobilizer writes code into the transmission control unit through the diagnostic port during a one-time setup, after which the adapter comes out.
The car still starts and still supports remote start. Movement into gear requires a personal sequence entered through the car’s own controls, such as the shift paddles, gear lever, and brake pedal. A driver who lacks the sequence cannot move the car, even with the key in hand. The maker lists more than 35 trillion possible sequence combinations. The method raises the time and effort a theft demands and serves as one layer in a wider setup. A BMW specialist demonstrated the install process in a video walkthrough.
- A hidden kill switch interrupts a circuit the engine needs and forces a manual step before the car starts.
- A GPS tracker or a Bluetooth tag placed out of sight helps police locate a stolen vehicle and recover it before it reaches a chop shop.
- A steering wheel lock works as a visible deterrent that steers a thief toward an easier target.
Steps drivers can take
- Store the fob in a signal-blocking pouch and keep keys away from exterior walls.
- Add a lock for the OBD-II port.
- Set up a software immobilizer or a kill switch for a second authentication step.
- Place a tracker for recovery.
- Park in lit, monitored areas and fit a visible steering lock for daily deterrence.
Each measure adds time and effort for a thief. Stacked together, they move a car down the target list and raise the odds of recovery if a theft happens.
