Keyless entry and push-button starting replaced a mechanical lock with a radio conversation. The security of that conversation rests on an assumption about distance that can be manipulated.
The system authenticates presence, not intent
A proximity key answers a low-power challenge from the car and returns a cryptographic response. If the response is valid, the car unlocks and permits starting.
The cryptography itself is generally sound. What the car cannot verify is where the key physically is, only that it received a valid answer.
Range is kept short deliberately so that a key inside a house should not respond to a car on the street. That short range is the security assumption.
Relay equipment extends the conversation
A relay attack uses two devices, one near the vehicle and one near the house, which forward the radio exchange between them.
The key answers normally because it is receiving a genuine challenge, and the car receives a genuine response. Neither is being fooled cryptographically.
The attack requires no knowledge of the key's secrets, which is why software updates alone have not solved it across the vehicle fleet.
Manufacturers responded with motion and timing
Many keys now include a motion sensor that puts the fob to sleep after a period of stillness, so a key resting on a hall table does not answer at all.
Ultra-wideband ranging is the more complete fix, measuring the actual time a signal takes to travel and rejecting responses that arrive too late to be genuine.
Because relaying adds delay, a timing-based measurement detects it directly rather than relying on the key to stay quiet.
The diagnostic port opened a second route
Once inside a vehicle, the onboard diagnostics connector provides access to the modules that program keys, since legitimate key replacement requires that capability.
Thieves have used that access to enroll a new key, which produces a vehicle that starts and drives normally with no forced entry evidence.
Manufacturers have added security access requirements and dealer authorization steps, and some vehicles now require an owner-set code before a key can be added.
Physical measures still matter
Signal-blocking pouches and metal containers stop a key answering at all, which addresses relay attacks without depending on the vehicle's own protections.
Steering locks and wheel clamps remain effective because they make the theft slow and visible, which is a different obstacle from an electronic one.
Aftermarket immobilizers that require a hidden action before the engine will run reintroduce a second factor the electronic system alone does not provide.