Car hacking: what is real and what isn't (relay attacks, key fobs)

Yes, cars can be hacked, in a few specific ways. Three are documented. Thieves can trick a keyless car into thinking your key is nearby. Researchers have shown they can take over some functions of connected cars. And some cars collect and share your driving data. Each has simple defenses. This guide explains what is real, what is overstated, and what to do.

How keyless car theft works

Many cars use a smart key. The car sends a radio message, and the key answers with a coded reply that proves it is genuine. A relay attack carries those messages farther than they should go. The car’s message is beamed to where your key is, for example inside your house. The key’s reply is carried back to the car. The car accepts the reply as valid because it comes from your real key. That is how researcher Ken Tindell describes it. AAA gives a similar account: thieves use radio equipment to relay messages between the car and a nearby fob, so the car believes the key is close.

We won’t explain how to build or use such equipment. What matters to you is the defense. Tindell says owners can keep their keys in a metal box that blocks the car’s radio message. He adds that some carmakers now supply keys that go to sleep when they sit still for a few minutes. AAA suggests a signal-blocking bag or case, keeping the fob away from doors and windows, and never leaving the fob inside the car.

Thieves who skip the key

Some thieves don’t bother with the key at all. In April 2023, researcher Ken Tindell published an account of an investigation he did with fellow researcher Ian Tabor. It covered thefts in which criminals tricked a car’s internal network into accepting fake messages. Tabor’s own car had been stolen. Tindell said the problem was not limited to one maker.

Two terms help here. An ECU (electronic control unit) is a small computer that controls one function of the car. The CAN bus is the network that lets ECUs talk to each other. AAA explains that CAN was designed for reliable communication, not for modern security threats. The researchers held back the details that would help copy the theft device. They wrote that the fix belongs to carmakers, for example by protecting messages so fake ones are rejected. Tindell is chief technology officer of a company that works on CAN security, so keep that in mind.

A signal-blocking pouch helps against relay attacks. It cannot stop a theft that skips the key and goes through the car’s internal network.

Can someone take over a car remotely?

Researchers have shown that it can be done to some cars. In 2015, security researchers demonstrated remote exploits of a passenger vehicle. The FBI and NHTSA, the federal agency for vehicle safety, reported in March 2016 that the researchers gained significant control over vehicle functions through wireless weaknesses. NHTSA judged the flaw an unreasonable safety risk. Almost one and a half million vehicles were recalled, and the manufacturer provided a software fix. The FBI said the identified vulnerabilities had been addressed.

Not every flaw is that serious, and not every flaw reaches the controls. The FBI noted that vulnerabilities may not always let an attacker reach every part of a vehicle’s systems. The safety risk grows if the access reaches critical controls.

A 2026 example: dealer-installed anti-theft devices

In July 2026, computer scientists at UC San Diego reported that at least 2.2 million cars carry a dealer-installed anti-theft device that could be misused over Bluetooth. Most of the cars were bought at dealerships in Southern California from 2017 on, but resale has spread them across the United States, Canada and Japan. The team withheld the technical details so thieves can’t copy their work. It told the manufacturer and NHTSA.

The maker released a fix on July 20, 2026. The owner applies it through the maker’s app. Many affected cars have a sticker reading “KARR” or “SWDS” on the driver’s-side window. A button under the dashboard also points to the device. If you see either, install the update.

What your car knows about you

Your car can also collect data. In January 2026, the FTC finalized an order with General Motors and OnStar. The FTC had alleged that GM collected precise location and driving behavior data from millions of vehicles and sold it, without clearly telling drivers or getting their consent. The order bans GM from giving that data to consumer reporting agencies, which are companies that compile reports on people, for five years. For 20 years, GM must get clear consent before collecting, using or sharing connected vehicle data, with exceptions such as emergency services. It must also let U.S. consumers ask for a copy of their data and its deletion. Where a vehicle can do it, drivers can turn off precise location collection and opt out of collecting location and driving behavior data.

That order covers GM. Other makers’ practices and settings differ, so check yours.

The FTC also lists what a car can store: phone contacts and address books you synced, app log-ins, the places and routes saved in the navigation system, and garage door codes.

How to protect your car and your data

1. Store your fob safely. At home, keep it in a metal box or a signal-blocking pouch, away from doors and windows. Never leave it inside the car.
2. Keep the software up to date. The FBI and NHTSA advise checking your vehicle identification number (VIN) for recalls at least twice a year, and checking the maker’s website for software updates.
3. Make sure update notices are real. The FBI warns that criminals can send fake update emails, or mail USB drives with harmful software. Get updates from the maker, your dealer, or a notice you can verify.
4. Be careful what you plug into the diagnostics port. The OBD-II port is a standard connector that repair shops use to check a car’s systems. The FBI says insurance dongles and similar devices can open a way into the car. Check the device maker’s security and privacy policies. Don’t plug in unknown devices.
5. Check for a dealer-installed device. Look for the KARR or SWDS sticker and update through the app if you find one.
6. Lock your connected-car account. AAA advises a strong, unique password and two-factor authentication. Our password generator can make the password.
7. Review your car’s data settings. Look in the car’s menu and the maker’s app. Turn off location sharing or data sharing you don’t want.
8. Park smart. AAA suggests a garage, or a well-lit, visible spot near cameras.
9. Clear your data before you sell. The FTC says to use the car’s factory reset if it has one, cancel or transfer subscriptions, and disconnect the maker’s app.

What can go wrong

• Fake updates. The FBI warns about fake emails and mailed USB drives. Don’t install software you can’t trace to the maker.
• A false sense of safety. A pouch stops relay theft, but not every method. Layers help more than one gadget.
• Third-party plug-ins. A convenient device in the OBD-II port can make the car easier to reach.
• Over-sharing in the app. Some features need your location or your contacts. Turn on only what you use.

What to do now

1. Put your key fob in a metal box or signal-blocking pouch tonight, away from the door.
2. Look up your VIN for recalls, and install any pending update. Repeat twice a year.
3. Check the driver’s-side window and the area under the dashboard for a KARR or SWDS device. If you find one, update it through the app.
4. Open your connected-car app and your car’s privacy settings. Use a strong, unique password with two-factor authentication.
5. If you think your car was hacked, check for recalls, then contact the maker or dealer, and report it to NHTSA and the FBI’s IC3, as the FBI advises.