Modern Car Keys in 2026: The Tricks, the Relay Attack Risk, and What to Check Before Buying a Used Car

The real battlefield is in your pocket

There is a lot of talk about batteries, horsepower, and infotainment, but in 2026 one of the most sophisticated, and most targeted, objects in your car sits in a small piece of plastic you carry in your pocket: the key. According to an analysis by Facile.it based on Interior Ministry data released in mid-August 2026, an average of 285 cars are stolen every day in Italy, along with nearly 90 motorcycles and scooters, putting the country fourth in Europe for theft rates behind only Luxembourg, Switzerland, and Sweden [1][2]. The technique most commonly used against keyless vehicles today is no longer a screwdriver, but a precise electronic attack known as the relay attack. Understanding how your car's key actually works, whether the car is old or brand new, has become an essential part of every used-car negotiation, for buyers and sellers alike.

From transponder to PEPS: thirty years of hidden logic in a fob

The turning point came in 1995, when the European Union made electronic immobilizers mandatory on every new car sold on the continent: a small passive transponder inside the key talks to a control unit, and if the code does not match, the engine simply will not start, even with the key physically turned. Within a few years came rolling code technology: every time you press the remote to unlock the doors, the signal changes according to an algorithm shared only by the key and the car, so an attacker cannot record the signal and reuse it later. From the mid-2000s onward, Passive Entry Passive Start (PEPS) systems spread widely: just having the key in your pocket lets you open the door by touching the handle and start the engine by pressing a button, without ever taking the key out. Convenient, yes, but it is exactly this silent automation that opened the door to the decade's most discussed security problem.

How the relay attack actually works

The relay attack exploits precisely the convenience of PEPS. It requires two cheap radio devices, often available online for a few dozen euros: the first is held close to the entrance of a home, where the key is presumably sitting on a table or shelf, and it captures its low-power signal; the second device, positioned near the car parked on the street, retransmits that amplified signal. The car, fooled into thinking the key is right beside it, unlocks normally [3]. The whole operation takes less than a minute and leaves no sign of forced entry. The simplest and cheapest countermeasure remains a Faraday pouch, a shielded case costing roughly 10 to 15 euros that blocks any radio signal leaving the key when it is not in use: it does not eliminate the risk but sharply reduces it, together with the habit of never leaving the key near a door or window.

The new 2025-2026 risk: multi-brand pirate firmware

Over the past year the threat has evolved. Alternative firmware sold outside official channels has begun circulating, promising to bypass the rolling code of several brands at once from a single captured signal: the list of affected manufacturers reportedly includes Chrysler, Dodge, Fiat, Ford, Hyundai, Jeep, Kia, Mitsubishi, and Subaru [3]. A tailor-made attack for each model is no longer necessary; a single configurable tool can target entire vehicle families, which helps explain why insurers report a surge of interest in anti-theft add-on policies, up from 14 percent of motor-insurance customers in 2022 to 24 percent today according to Facile.it's own observatory [1]. And it is not just a four-wheel problem: motorcycles and scooters with keyless systems show the same relay-attack vulnerabilities as cars, with the added difficulty that two-wheelers often lack physical barriers such as garages or gated driveways [4].

The digital key is the real answer, but not yet for everyone

The most solid response the industry is building is not a stronger remote, but the elimination of the remote altogether. Smartphone digital keys combine Bluetooth with either NFC or Ultra-Wideband (UWB) technology to establish a connection with the car that also measures the phone's precise spatial position, not merely its presence somewhere nearby: this makes a simple signal relay far harder to pull off, because the system also checks real distance and direction [5][6]. Apple, Google, and Samsung already offer digital keys built into their respective wallets for a growing selection of models, with baseline requirements such as iOS 15 or Android 12 for UWB mode, and case studies like the Polestar 3, where tapping the phone against the door handle unlocks the car and placing it on the reader between the front seats starts the engine [5]. The limitation today is reach: the feature remains tied to specific brands and models, often in the mid-to-premium segment, and does not yet fully replace a physical spare key.

Buying or selling a used car: what actually changes for the key

With a used car, the key stops being a minor detail and becomes a genuine negotiating point. The number of keys handed over with the car is the first thing to check: the standard kit is two working keys, and a single key on offer is almost always worth factoring into the price, not just for the inconvenience but for the real cost of fixing it. Coding a new key through the control unit's OBD port, the same method dealerships use, typically runs 50 to 300 euros depending on make and model, and climbs further if the unit's PIN code is also needed because no original key remains [7]. Sellers should keep, and be ready to show, proof of exactly how many keys exist for the car: a third key that was never handed over is a quiet security risk for the buyer. Buyers looking at a model with a digital key, meanwhile, need to confirm that access is properly revoked from the previous owner's account and reissued to their own, a step that on brands like Tesla or BMW requires an explicit in-app action rather than happening automatically at the change of ownership.

A practical checklist before you sign

A few checks take two minutes each and matter more than a stamped service book: physically test both keys during the viewing rather than taking the seller's word for it; ask when the fob battery was last replaced, a small detail that often reveals how neglected the key has been relative to the rest of the car; verify that the immobilizer warning light on the dashboard turns on and off correctly at start-up, a sign the system is communicating properly with the control unit; and ask whether the model supports a digital key and, if so, request removal of any previous access before the ownership transfer completes. On VendiVoce, anyone listing a car or motorcycle for sale can note in the ad exactly how many keys come with it: a small detail, but in an honest negotiation it carries as much weight as a properly stamped service record.