Relay Attack Protection for Keyless-Entry Cars in India — Faraday Pouches, PINs, GPS and Legal Recourse

Modern smart keys use a 125 kHz low-frequency pulse from the car to wake the fob and a higher-frequency UHF response (around 433 MHz in India) from the fob back to the car. When the car detects the fob within roughly one to two metres, it unlocks and enables start. The exchange is cryptographically signed on most brands, so replay attacks on the signal itself are defeated — but the distance check is not.

The attack exploits distance, not encryption. Thief A stands near the house with a suitcase-sized antenna and amplifier that picks up the weak LF pulse from the car wake-up and re-transmits it at high power toward wherever the key fob is inside the house. The key receives this boosted pulse, thinks the car is right next to it and replies normally. Thief B, holding a second amplifier near the car door, picks up the reply and re-transmits it to the car. The car's handshake completes, the door unlocks and a second handshake starts the engine.

The whole attack is done in 60-90 seconds. A commercial kit costs between 400 and 1500 US dollars on the grey market and has been intercepted by customs at several Indian airports. The technology is commoditised; thieves do not build them any more.

There are two common attack scenarios in India. The home-parking scenario — key on a table near the door, car in the driveway or society parking within 20-30 metres. The restaurant or mall scenario — key in a handbag or pocket within 10-20 metres of the car through walls. Both can be stopped by the same defence: shield the key so it never receives the amplified pulse.

A Faraday pouch is a fabric pouch lined with metal mesh (usually nickel-copper or aluminium weave) that blocks radio-frequency signals from entering or leaving. Drop your smart key into a Faraday pouch and the amplifier outside cannot wake it, so the attack dies at step one. Pouches cost 500 to 2000 rupees on Amazon India and Flipkart from brands like Defender Security, Lockidy, Silent Pocket and several Indian private labels.

How to choose one. Look for dual-layer shielding — a single-layer cheap pouch often lets weak signals leak. Test after buying: put the key inside, close the pouch fully and walk up to your car; if the door still unlocks at one metre or engages on button press, the pouch is defective and you should return it. A good pouch will block the signal completely even when the key is pressed against the car body through the fabric.

Build a habit. The pouch is useless if the key is left on the hallway table half the time. Keep the pouch or tin next to the front door, drop the key in every time you come home and your risk of relay attack at home drops by 80 percent on day one.

Several Indian-market cars allow the owner to disable the passive entry and passive start function entirely, turning the smart key into a button-only fob. This is the single most powerful software defence against relay attack because the car simply stops listening for the amplified wake-up.

Brand-by-brand support in 2026. Hyundai Creta, Verna, Alcazar, Ioniq 5 — disable via Bluelink app and some models via infotainment menu. Kia Seltos, Sonet, Carens, EV6 — disable via Kia Connect app. Tata Nexon, Punch, Harrier, Safari — partial support via the iRA platform; check the app and owner's manual. MG Astor, Hector, ZS EV — disable via iSmart app. Mahindra XUV700, Scorpio-N, XUV400 — disable via AdrenoX on certain variants. Maruti Suzuki — Connect-equipped variants of Grand Vitara and Invicto offer immobiliser controls but passive-entry disable is limited to specific models; check the owner's manual.

Where the feature does not exist, the fallback is to press the lock button on the fob twice after parking. On many cars, double-pressing lock disables passive entry for that parking session and requires an active button press to unlock. This is not a permanent disable but it works for overnight parking if you remember to do it every night.

Do not confuse disabling passive entry with disabling the car. You still need the key to start it, just by pressing the fob's unlock button or by touching the key to the start button (backup transponder read). This step takes two extra seconds of your day and removes an entire attack vector.

Several connected-car platforms in India now offer a PIN-to-drive feature — a 4-digit or 6-digit PIN that the driver must enter on the infotainment screen within 30-60 seconds of engine start, failing which the car auto-immobilises after a short interval. Hyundai Bluelink, Kia Connect, Tata iRA, Mahindra AdrenoX and MG iSmart variants offer this on selected models.

Enabling PIN-to-drive is usually a one-time setup in the app. Pick a PIN you will remember, set the inactivity window (typically 30 seconds), and enable auto-activation for overnight parking. Even if a relay-attack thief starts the car, they get 30-60 seconds before the car refuses to drive further — not enough time to escape a society gate.

Remote immobiliser is the sister feature. Every major connected-car platform lets you send a remote immobilise command from the app if the car is stolen. In real-world cases this has recovered vehicles in Delhi and Bengaluru where owners sent the command within minutes of the theft, the car stopped at the next red light and police traced it via GPS.

A hardwired GPS tracker with a remote-cut-off relay is the independent second layer every Indian keyless-entry owner should consider. Brands popular in India include Jimi, Concox, TVT, Traqo, LetsTrack and CarCation, with hardware costs between 3000 and 10000 rupees and subscription fees of 1000-3000 rupees per year for live tracking.

The key features to look for. Live GPS tracking via mobile app with 10-30 second refresh. Geofencing alerts — SMS and push when the car leaves a set zone. Ignition on/off alerts. Remote immobiliser relay that can cut the fuel pump or starter motor via app command. Internal backup battery so the device keeps tracking even if thieves cut the main battery. Installation inside the dashboard or behind the glovebox so thieves cannot find and disable it quickly.

For the full shopping and installation guide — including how to pick between the GPS-only and GPS-plus-immobiliser tiers and how to verify installation quality — see our GPS anti-theft guide for India. It covers tracker brands, subscription pricing and the practical test checklist for your installer.

Many new Indian-market cars sold after 2023 now include a factory-fitted eCall or connected-car tracking module as part of AIS-140 compliance, but these are primarily for accident emergency use and are not configured as anti-theft trackers by default. An aftermarket tracker with immobiliser is still worth adding for theft protection.

The humble steering lock has had a revival as relay-attack stories spread. A 1500-3000 rupee mechanical steering lock (Club-style bar across the steering wheel) or 2500-5000 rupee pedal lock adds a visible deterrent that forces a thief to bring an angle grinder — which takes noise and time. Organised relay-attack crews prefer silent, scratchless thefts and will usually move on to an unlocked target.

Wheel clamps are used by some Indian owners for long-term storage parking, especially for low-use second cars and collector vehicles. Cost is 2000-5000 rupees. Not practical for daily use but excellent for week-plus parking.

The reason these old-school defences are back is visibility. Relay-attack theft is an optimisation crime — the thief picks the easiest car in a row of cars. A steering lock in view through the windscreen is often enough to move the attack to the unprotected car parked next to you. The physical barrier itself does not need to be unbreakable; it needs to be visibly harder than the next car.

Physical anti-theft is complementary to electronic defences, not a substitute. A Faraday-pouched key plus a steering lock plus a GPS tracker is the layered stack that defeats 99 percent of attacks — the thief cannot even start the car, and if they somehow flat-tow it away, the tracker catches them before they strip it.

Call 112 first. The all-India emergency number now takes vehicle-theft reports and can circulate the number plate to highway checkpoints within minutes. Call your insurance company's claim helpline within 24 hours — this is a policy condition, not a suggestion, and delayed reporting is a common reason for claim denial.

File an FIR at the jurisdictional police station — under Section 379 of the IPC (or the equivalent BNS section for motor-vehicle theft) plus, where there is evidence of electronic attack, Section 66 of the IT Act 2000 for unauthorised access to a computer system. Bring the RC, insurance policy, driving licence, two spare key fobs, any CCTV recording you can extract from your society and photos of where the car was parked. The police will give you a copy of the FIR — guard this document, you will need it for every subsequent step.

Notify your connected-car app and push the remote immobilise command immediately. Notify your GPS tracker provider for live-trace assistance. Notify your insurer in writing (email plus phone) and request the claim form and surveyor appointment.

For the step-by-step insurance-claim documentation and timeline — what the insurer will and will not pay for, and how to accelerate the settlement — see our guide to filing a car insurance claim fast in India. Theft claims follow a slightly different path than accident claims — the surveyor usually inspects the recovered vehicle if found, or releases the total-loss settlement if the car is not recovered within 30-60 days.

Motor-vehicle theft in India is primarily prosecuted under Section 379 of the Indian Penal Code (or the corresponding provision of the Bharatiya Nyaya Sanhita 2023 where states have moved to the new code). Relay-attack theft additionally involves unauthorised electronic access to a vehicle's immobiliser system — which is a computer system under the IT Act 2000 definition — and so attracts Section 66 of the IT Act for the electronic-intrusion component.

Why the IT Act matters. Section 66 carries up to three years imprisonment or fine up to 5 Lakh rupees and, more importantly, triggers investigation by the state cyber-crime cell, which has better forensic capability to trace relay-attack equipment than a regular station. If your FIR specifically mentions 'keyless entry bypass via electronic signal amplifier', insist on an IT Act section being added to the charge sheet.

Insurance recovery follows a standard path. Own Damage policies with comprehensive cover pay out the Insured Declared Value (IDV) minus compulsory deductibles if the vehicle is not recovered within 60-90 days. Third-party-only policies do not cover theft at all — something many buyers of 5-year-plus-old cars do not realise. The consumer-protection angle on claim denials (for example, if the insurer argues you were careless by leaving the key near the door) is covered by the Consumer Protection Act 2019 and the IRDAI insurance ombudsman process.

Statute of limitations for insurance dispute — if the insurer repudiates your claim, you have up to 2 years to approach the insurance ombudsman under the IRDAI ombudsman scheme, and further 3 years to approach the consumer forum under the CPA 2019. Keep every written communication and the repudiation letter.