Key fob relay attacks let thieves unlock and start keyless cars in seconds by boosting your fob signal from inside your home. Here are the practical, layered defenses that actually work in 2026, from Faraday pouches to starter kills.
What Is a Key Fob Relay Attack and how Does It Work?
A relay attack (or what some people call signal boosting) is a two-person job. Another thief pulls up to your house with a device that picks up the weak signal emitted by your key fob 24-7. The other thief is next to your driveway with a pair transmitter that plays back that signal to the car. The car's computer detects an active fob within range, unlocks the doors and allows the engine to start. The entire handshake can take less than one minute and there is no broken glass, not even an alarm and many times it does hardly leave any trace of something happening at all until the car has left.
These hacks are real shots, not out of some fictitious book. The technical capability for a working relay attack on keyless entry systems was established when researchers at the University of Birmingham in the UK demostrated just such an attack (2018), and this technique has only become cheaper since. Push-to-Start systems went mainstream in the mid-'00s, and smart car theft followed right along with it. In a report looking into how cars are stolen and recovered in the UK, vehicle tracking company Tracker found that no keys were used whatsoever when 80% of all stolen-and-recovered vehicles were taken.
The underlying technology is either radio frequency identification (RFID) or similar means of wireless communications between the fob and vehicle. The fob is made to respond to the vehicle on its own; when nearby, it uncomplainingly broadcasts not just in your vicinity but also behind a front door as long as it's resting somewhere close—in this case, upon a hook. That is indeed the biggest weakness of the system, and this is precisely what a Faraday pouch or batery-saving mode are intended to close.
Why Faraday Pouches Are the First Line of Defense
A Faraday pouch is a signal-blocking bag, lined with conductive material. When you drop your fob inside and close it completely, the pouch effectively acts as a cage that prevents radio waves from escaping or entering. Relay team has their signal waiting at a router, but nothing to relay because there is no incoming signals trate. For all of these reasons it keeps popping up in enthusiast threads and insurance advice alike, this is literally the cheapest most light touch protection you can add right now, not to mention a basic pouch starts from just $15.
The catch is quality. Budget pouches are either shielded using thin or poorly sewn cloths, and that lining can wear out as it is folded multiple times. A pouch that was functioning well in January may be starting to leak by Summer time. The fix is simple: test it. Place your fob in, close up the bag, and walk to the car. If the door does unlock or you get to start your car, that proves the pouch is no longer functioning and will need replacing. I check mine every few months and I keep a spare in my drawer, ensuring that there's never a dead pouch leaving me open to attack.
There's a practical limit to using Faraday pouches too; here's what you need to know. Full closure is the only way they work so you can manage to leave a fob protruding from its flap and still be transmitting. They do sod all for a fob in your pocket when you walk round the parking lot. They protect the key, not your car; they should be a layer in the stack rather than all there is to your plan.
It means where you store the fob is just as important too Keys left on a hook near your front door are well within reach of an opportunist facing their porch. This moves them further into the house — away from doors and windows, so a relay device has to travel less distance. Add a pouch to that and you have blocked the simplest entry point into your vehicle.
How to Use Battery-Saving Mode on Your Key Fob
A lot of new fobs have a battery-saving feature that switches off the key's automatic activation signal. When the passive broadcast is off, it falls silent until you press a button or touch the fob to something—and since that means nothing outside your home has anything to grab. This is free, with no installation required and surprisingly works on a large number of vehicles once you know the button sequence.
Toyota is the classic use case here. To enter battery-saving mode on most Toyota models just hold down LOCK and then hit UNLOCK twice. You will now have to press a button on the key fob because it stops transmitting and your car will not unlock passively if you approach. If you want to turn it back on, just press any button on the fob. The setting is buried in the infotainment menu on other cars, or a different sequence altogether can be used to access it — so don't assume your car doesn't support it without checking your owner manual.
The trade-off is convenience. Battery-saving mode is active, so you press the fob to access using car instead of grabbing handle. This extra second is basically the whole point: The car won't unlock when a fob sits quietly in your house. By only having it on at night and turning it off in the morning, you get most of the avoidance with almost none of the daily friction.
Battery saving mode is model specific and not available on devices by every brand. If it does not now, putting the fob in a Faraday pouch will have similar effect, while one with an actual on-off switch would also do. In each case, the goal is exactly the same: ensure that your key isn't broadcasting when you're not using it.
Starter Kill and Secure Push-to-Start: Stopping the Engine
Even if thieves relay your fob signal and get inside the car, they still need to start the engine. That is where a starter kill comes in. A starter kill relay sits between the ignition system and the starter motor and keeps the starter disabled until the security system is disarmed with your remote or your phone. A relay team can open the doors, but the engine will not crank.
Compustar builds this into its systems as Secure Push-to-Start and Starter-Kill, and both features are available with most Compustar systems. The companion DroneMobile App lets you arm and disarm from your phone, so the vehicle stays immobilized even if the fob signal has been cloned. This is one of the few defenses that directly attacks the theft at the point of starting rather than at the point of entry, which is why installers tend to recommend it as the backbone of a layered setup.
The trade-off is cost and installation. A starter kill is not a plug-in accessory; it has to be wired into the vehicle by a professional, and a botched install can leave you stranded or void part of your warranty. Expect to pay for both the hardware and the labor. For a car that would be painful to lose, that is usually money well spent.
A ghost immobiliser is a close cousin. Instead of cutting the starter, it requires a secret sequence of button presses, often using existing steering wheel or dashboard controls, before the car will start. There is no visible device for a thief to find and defeat, which makes it a strong complement to a starter kill. Together, they mean a relayed signal gets a thief inside a car that still will not move.
Extra Steps: Key Placement, Ghost Immobilisers, and More
Layers are what separate a car that gets stolen from a car that gets left alone. No single product stops every attack, but stacking a few cheap and mid-priced measures raises the effort and risk for a thief to the point where they usually move on to an easier target. The table below summarizes the main options, their rough cost, and what each one actually stops.
Extra Steps: Key Placement, Ghost Immobilisers, and More
| Defense | Rough Cost | What It Stops | Main Drawback |
|---|---|---|---|
| Faraday pouch or box | From $15 | Signal interception at home | Cheap linings fail over time |
| Battery-saving mode | Free | Passive fob broadcasting | Model-specific; adds a button press |
| Starter kill / Secure Push-to-Start | Hardware plus install | Engine start after entry | Professional installation required |
| Ghost immobiliser | Hardware plus install | Engine start, hidden from view | You must remember the code |
| Key fob reprogramming | Dealer rates | Old or cloned codes | Costly and inconvenient |
Beyond hardware, habits matter. Keep keys out of sight and away from the front of the house. Physically check that the car is locked rather than trusting the walk-away auto-lock, since relay devices can interfere with that handshake. If your car has an app with remote status, confirm the doors are secured before you go to bed. None of these steps is glamorous, but each one removes an opportunity.
Reprogramming the fob periodically is another option, particularly if you bought the car used or suspect a previous owner retained a key. A dealership can wipe old codes and issue fresh ones, which closes the door on a cloned credential. It is expensive and inconvenient, so most owners treat it as a once-every-few-years measure rather than a routine task, but for a high-value vehicle it is a reasonable addition to the stack.
Limitations of Rolling Codes and Reprogramming
Rolling codes were supposed to make replay attacks impossible. Every time you press the fob, a pseudorandom number generator (PRNG) produces a fresh code, and the car accepts only the next expected value in the sequence. Capture an old signal and it is useless, because the car has already moved past it. Most newer vehicles rely on rolling codes, and on paper they close the relay window entirely.
In practice, the scheme has a known weakness. Security researcher Samy Kamkar demonstrated a rolljam attack that jams the first signal and captures it while the owner presses the button again, harvesting two codes and leaving one spare to replay later. Vehicles that depend solely on rolling codes remain vulnerable to this workaround. That is why rolling codes should be treated as a baseline, not a guarantee, and why physical layers like a starter kill still matter.
Faraday pouches have their own failure mode. Because many are built from inexpensive materials, the shielding can wear out and stop blocking signals without any visible damage. A pouch that passed a test last year may be transparent to radio waves now. Testing regularly, or replacing pouches every year or two, is the only reliable way to know yours still works.
It is also worth remembering that relay attacks are not limited to cars. The same signal-boosting technique has been used against contactless payment cards, and many vehicle thefts likely go unreported or undetected because owners never realize how the car was taken. That reporting gap makes the problem look smaller in the statistics than it feels to anyone who has lost a vehicle. Treating every layer as fallible, and adding redundancy, is the most honest approach.
What Should You Do First?
If you want the fastest return on effort, start with the key. Buy a quality Faraday pouch or box, store your fob inside it whenever the car is parked at home, and move your keys away from doors and windows. That single change defeats the most common relay setup, and it costs about as much as a tank of gas. Test the pouch with your own car every few months so you know it still blocks the signal.
Next, turn on battery-saving mode if your vehicle supports it, and use it at night. Then consider a professional starter kill or Secure Push-to-Start system, especially if you drive a high-theft model. A ghost immobiliser is a strong follow-up for anyone who wants a hidden layer. Finally, build the habit of physically confirming the car is locked. Layered, tested, and consistent beats any single gadget, and it is the approach that keeps working as thieves refine their tools.
Frequently Asked Questions
What is a key fob relay attack and how does it work?
A relay attack uses two thieves with radio transmitters. One intercepts the key fob signal from inside your home, while the other relays it to your car. The vehicle believes the fob is nearby, so it unlocks and allows the engine to start. The entire process can take under a minute and leaves no visible damage.
Does a Faraday pouch really stop relay attacks?
A Faraday pouch blocks signals when it is fully sealed, so the relay team has nothing to capture. However, some inexpensive pouches use thin shielding that degrades over time and stops working. Choose a quality pouch and test it regularly by sealing your fob inside and checking whether the car still unlocks.
How do I enable battery-saving mode on my key fob?
On many Toyota models, hold down the LOCK button and press UNLOCK twice to enable battery-saving mode. The fob stops sending its automatic activation signal, so a relay device outside your home has nothing to grab. To disable it, simply press any button on the fob.
What is a starter kill and does it prevent relay attacks?
A starter kill disables your car's starter until you disarm the alarm with a remote or app. Even if thieves relay the fob signal to open the doors, they cannot start the engine without your Compustar remote or DroneMobile App. It requires professional installation but stops the theft at the starting point.
