Relay attacks and keyless theft: how it works and what is covered

A relay attack lets a thief unlock and start a keyless car by tricking it into thinking the real fob is next to it, and a CAN-injection attack lets a thief fake the key signal from inside the car's wiring. Neither leaves a broken window or a punched ignition. If you carry comprehensive coverage, theft is covered whatever method was used, but the lack of forced entry means the insurer will ask more questions about keys, parking and who had access. Documenting those answers early is the best protection for your claim.

This article explains the two attacks in plain terms, how an insurer evaluates a theft with no sign of entry, and which defenses are worth the money. The vehicle examples are dated, because manufacturers change their systems and security researchers keep finding new weaknesses.

How a relay attack works

A modern keyless car (also called passive keyless entry and push-button start) is built to unlock when the fob is within a few feet and to start when the fob is inside. The fob and the car talk by radio. The car sends a challenge and the fob answers, and the car estimates how close the fob is from the signal.

A relay attack does not break the code. It stretches the distance. One thief stands near your house or the place the fob is kept, holding a device that picks up the fob's signal. A second thief stands at the car with a second device. The pair relays the car's challenge to your fob and the fob's reply back to the car, so the car behaves as if you were standing next to it. Security analysts describe it as placing one radio device near the car and another near the real key so that the key's signal is extended and the car unlocks and starts.

What the 2016 NICB test showed

The National Insurance Crime Bureau (NICB) tested a relay device in December 2016. According to its release as reported by Insurance Journal, NICB bought a "relay attack" unit from an overseas company and used it over two weeks on 35 makes and models, at a dealership, a used-car lot, an auction and on privately owned vehicles. The device opened 19 of them (54%) and started and drove away 18 (51%); after the cars were driven off and shut down, it restarted 12 of those 18. NICB's chief executive said the group had "seen for ourselves that these devices work," and noted they would not work on every make and model. The test was informal and is now ten years old, so it shows how the technique behaves, not how many cars are vulnerable today.

Two features explain the insurance consequences. First, the car is started and driven away by someone who has no key, but the electronics report a valid one. Second, a car that is already running generally keeps running if the fob moves out of range, which is how a car started with a relay can be driven off.

Why newer systems are harder to relay

Older keyless systems judge distance by the strength of the radio signal, so an amplified signal can fool them. Ultra-wideband (UWB) radio measures distance by timing the signal, which makes a relay much harder. The same VicOne analysis calls UWB "highly resistant to relay attacks," while warning that implementation matters: it describes a car that supports UWB but still unlocks over Bluetooth, which left it exposed. No distance check is a permanent cure. Treat a manufacturer's claim that a car is "relay-proof" with caution, and ask what exactly the system checks.

How CAN-bus injection works

A relay attack targets the fob. A CAN-injection attack targets the car. The controller area network (CAN) bus is the wiring that lets a car's computers talk to one another. In most cars, those messages are not authenticated: a computer that receives a message from another assumes it is genuine.

In April 2023, security researcher Ken Tindell of Canis Automotive Labs published a technical write-up of a theft of a Toyota RAV4 owned by researcher Ian Tabor. According to Tindell's analysis, thieves pulled the bumper away and reached the headlight wiring, which gave access to the CAN bus. They then injected fake messages that looked like the smart key receiver reporting a valid key. The message told the engine computer to disable the immobilizer and a second told the door computer to unlock, so the thieves could "simply open the door, get in, and drive the car away." Tindell wrote that the components of the injector cost about $10 and that the device was disguised as a Bluetooth speaker. The Register's account matches: Toyota's connected app had logged diagnostic trouble codes before the theft, and the faults pointed to communication failures on the bus.

Tindell argued the weakness is industry-wide and not limited to one maker. His suggested fixes were a software check that watches for the specific signal errors an injector causes, and, as the permanent fix, cryptographic authentication of messages between computers, which takes time because of key management and testing. I could not find published confirmation, as of November 2026, of which specific models have received such a fix, so if you own a model that researchers have named, ask the dealer whether a security software update exists for your VIN.

How common is it?

I found no published national count of relay or CAN-injection thefts, and NICB's annual theft reports do not break thefts out by method. Overall theft numbers are falling: NICB reported 659,880 vehicles stolen in 2025, down 23% from 2024, and 268,415 in the first half of 2026, down 21% from the same period of 2025. The reported thefts include many methods: the most stolen models in 2025 included the Hyundai Elantra and Honda Accord, and Hyundai and Kia vehicles, which spread through a different technique, were 14% of the total. Do not assume that keyless attacks are driving the headline numbers, and do not assume they are rare either.

What your insurance covers

A theft by any method is a comprehensive coverage claim. If you carry comprehensive and the car is stolen, the insurer pays its actual cash value minus your deductible; Progressive says this may apply even if the car was stolen with the keys in it. Nothing in a standard policy requires proof of forced entry. The coverage depends on the loss being a theft, not on how the thief got in.

What the claim includes depends on the outcome:

• The car is never found. The claim is settled as an unrecovered theft: see an unrecovered stolen car: the waiting period and settlement for the waiting period, rental limits and loan issues.
• The car is found damaged. Comprehensive pays for the damage after the deductible, as described in your stolen car was recovered: three ways the insurance claim can go.
• Items inside are gone. They belong on a homeowners or renters claim, not the auto policy.
• Only the key was stolen or lost. A lost fob is not a theft of the car. Progressive's guidance says comprehensive can pay to replace a key if the car is recovered but the key is not, but it will not cover lost keys, and smart keys can cost several hundred dollars or more to replace and program.
• You have only liability coverage. Then nothing pays for the car.

The method does not change the coverage; what the insurer checks is whether the facts match.

How insurers evaluate a theft with no broken lock

A car missing with no glass on the ground can mean a relay or injection theft, but it also looks like an owner give-up, a staged theft or a theft by someone with a key. Investigators therefore ask structured questions, and a legitimate claimant should expect them. They are not an accusation. NICB's own description of relay theft is that there is no warning or explanation for the owner and that owners often think the car has been towed, which is exactly why a no-forced-entry theft is plausible.

Typical questions, and what helps you answer well:

1. How many keys exist, and where was each one? Produce every fob you own. Say where each was kept the night of the theft. A fob inside the house near the door is the typical relay target, and it supports your account.
2. Was the car locked, and was a fob or spare left inside? Be honest. Progressive says payment may still apply even with the keys in the car, and policy-specific consequences are discussed in keys left in the car or engine running: will theft coverage still pay?.
3. Where was it parked, and was there camera coverage? Doorbell cameras, neighbors' cameras, a garage's cameras and traffic cameras may show a vehicle leaving, or the thieves' approach to your door with a device.
4. Was there earlier tampering? In the RAV4 case, the headlight and bumper area had been damaged in the days before the theft. Report any such damage to the police at the time and keep photographs.
5. What data does the car have? A manufacturer's connected-car app, an installed tracker or a telematics unit can show the location, a start event and diagnostic trouble codes. Ask the dealer or manufacturer to preserve them, since they can be overwritten.
6. Any financial pressure on the car? Investigators commonly look at the loan balance and recent mechanical trouble in a theft claim.

Where a claim is flagged, the insurer may refer it to a special investigations unit; the process is described in how insurers investigate a stolen car claim. The best response is a complete, consistent file: police report, all keys, purchase and maintenance records, and any camera or app data.

A short claim checklist

• File the police report right away and name the make and model; ask that the report note that the car has keyless entry.
• Call your insurer the same day and tell the adjuster plainly that you suspect a keyless attack.
• Hand over every fob, labeled by where it was kept.
• Save camera footage before it is overwritten and give copies to both police and the adjuster.
• Ask the manufacturer to retrieve connected-service logs for the time of the theft.

Defenses that help, and what each costs

No single measure stops every attack. The usual advice is layers, and the layer you can afford depends on how likely your car is to be targeted.

NICB's long-standing advice, repeated after its 2016 test, is to always lock the car and take the fob or keys with you. A PIN-to-drive feature, such as the one Tesla offers, is described by VicOne as a second factor: a thief who relays the unlock still cannot drive without the PIN.

To test a pouch, put the fob inside, stand beside the car and try the door handle. If the car unlocks, the pouch is not blocking the signal. Test it again after a few months of use, because creases and wear can open gaps.

Manufacturers also do respond with software. A relevant precedent is the Hyundai and Kia anti-theft software upgrade. The Insurance Institute for Highway Safety reported that vehicles with the upgrade, which began rolling out in February 2023, had 53 percent lower theft claim frequency than those without it as of December 2023, although vandalism claims rose. That attack was a different technique, but it shows that a fix is possible and that owners usually have to get the update themselves. Ask your dealer about security updates, and check NHTSA's recall lookup for your VIN, though a theft-security update may be issued as a service campaign instead of a recall.

Do anti-theft devices earn a discount?

Sometimes, but the discount is rarely large, and it depends on the device. Insurers' discounts for anti-theft equipment typically apply to comprehensive coverage and apply to factory or approved devices: alarms, immobilizers, tracking and recovery systems. A steering-wheel lock or a signal pouch usually does not earn one, because the insurer cannot verify it is used. Florida requires insurers that write comprehensive to include anti-theft discounts in their rating manuals for factory-installed or state-approved devices and recovery systems, though the statute does not set a percentage. Other states have their own rules, so ask your insurer or your state's insurance department.

A worked example, with hypothetical numbers. Your comprehensive premium is $320 a year and your insurer gives a 5% discount for an approved tracker. That is $16 a year. The tracker costs $120 plus a $50 annual subscription. On the discount alone it never pays back; the case for it is recovery and deterrence. The guide to safety feature and anti-theft discounts lists which features insurers usually recognize.

How theft trends reach your premium

Insurers price comprehensive coverage from claim data. When thefts of a particular model or in a particular area rise, the cost of comprehensive claims for that group rises, and the insurer files higher rates for it. That happens through the vehicle's rating symbol and the territory rating for the place it is kept. The Highway Loss Data Institute's figures for Hyundai and Kia show how fast it can move: theft claims for 2003-23 models were more than 11 times their first-half-2020 level and more than 8 times other brands' rate in the second half of 2023, according to the IIHS report cited above. Premiums respond to claim cost, not to the technique, so a keyless method that hits one model hard shows up in that model's comprehensive price.

Because insurers see claims by model and area, the practical lesson is to ask your insurer how it treats your model and ZIP code, and to read The most stolen cars in America for what the data show. A claim in your own history affects your premium separately.

Common questions

Can my insurer deny the claim because there was no forced entry?

Lack of forced entry alone is not a coverage exclusion in a standard policy, but the insurer can investigate and can deny a claim if it finds the loss did not happen as reported or that you made false statements. The way to protect yourself is to answer accurately, produce all keys and keep records. If a claim is denied, the denial should cite the policy provision; the state insurance department takes complaints.

Does it matter if I left the fob in the car?

It can matter, and policy wording and state law vary. Progressive's public guidance says payment may still apply when the keys were in the car, and the details depend on your insurer. Whatever happened, say so.

Are keyless cars more expensive to insure because of relay theft?

Not as a category. Insurers price each model from its own claim experience. A model with a high theft rate costs more to insure on comprehensive, whatever the entry method.

Will a Faraday pouch or steering lock lower my premium?

Usually not directly. Insurers tend to credit factory or approved devices that they can verify. These measures are justified by what they prevent, not by a discount.

Is a stolen key fob a theft claim?

If only the fob is stolen and the car stays put, comprehensive is unlikely to pay for the key, and you should reprogram or replace the fob and consider a new set of keys. If the fob was stolen with the car, it is part of the theft claim.

Key takeaways

• Relay attacks fool a car into thinking the fob is nearby; CAN-injection attacks fake the key signal from the car's wiring. Neither leaves a broken window.
• Comprehensive covers theft whatever the method, but a theft with no forced entry draws more questions about keys, parking and access, so document everything early.
• Keep fobs away from doors, test any signal pouch, use a physical lock or a PIN-to-drive feature where available, and ask the dealer about security updates for your VIN.
• Discounts for anti-theft equipment are usually small and apply to factory or approved devices; rates follow claim cost for the model and area, not the method.
• Vehicle examples and fixes change quickly, so check the current position with the manufacturer and your insurer.