Relay Attack Defence for Aftermarket PKE

If you want the mechanics of how a relay attack works, read How Does a PKE Keyless Entry System Work? first. That article covers the two-transceiver trick, the rolling-code layer and why detection range matters. This one is narrower: what you can change on the car during an installation, and what you cannot.

You cannot change the radio protocol. You can change when the car listens, where it listens from, and how long it keeps listening — three levers that are within an installer's reach and rarely discussed.

First, the Honest Part

What an aftermarket kit can and cannot do

An aftermarket PKE kit is a radio system with a defined detection radius: a low-frequency challenge goes out around the car, a key inside that field answers on a high-frequency channel, the car unlocks. The chain is fixed by hardware design. What is not fixed is the three things you control at installation time — whether sensing runs at all, where the antennas sit, how the unit is powered. Those are the levers in the next section.

The protocol you cannot change: consumer PKE measures field strength, not time-of-flight, and field strength is exactly what an attacker extends. Nor can you change the customer's habits.

Why "anti-relay" is a marketing word

You will see "anti-relay" on boxes across this category. Ask what it means and the answer is usually rolling codes, a shorter detection radius, or a sleep timer. Each is a real mitigation; none is a defence against a relay attack as such — rolling codes defeat recording and replaying, a different attack, while radius and sleep shrink the window without closing it.

We have no third-party relay-attack test reports for any model in this range, so we do not print the word and this article will not either. FCC / EMC / RoHS reports exist for most models; they are not a relay test.

The only claims you can safely make

Run any claim you are about to make through this table.

Three Levers an Installer Actually Has

Lever 1 — Turn PKE sensing off

The strongest lever, and the one sitting unused on most installed cars.

How it works: on models that support it, PKE sensing toggles from the remote, using the same arm/disarm action the customer already uses. The 8803 and 888 document it as PKE on/off by remote; the 886 platform and 8808BLE call it a car-wash mode — same capability, named for its most common use. On the 886 the same page states it can also be switched off for towing or workshop servicing.

When to recommend it: the car is parked on the street or in a shared car park overnight; the owner leaves it for weeks; the key habitually sits near a door or window — the condition a relay attack needs; or the car is a theft target (4x4, van with tools, parts demand).

The cost: the car no longer unlocks as the owner walks up; they use the remote like a normal fob. That is a real loss of the feature they paid for — say so before they find out in a car park with an armful of shopping.

Which models: most of the range, not all. Confirmed on the 8803, 888, 886 and 886BT (one page, 886BT adds Bluetooth) and 8808BLE. The 8003PKE page asks buyers to confirm sensing specs before ordering and the 8807 page lists no PKE on/off function — do not assume either way.

Lever 2 — Antenna placement

The lever only an installer can pull, and the one most often skipped because it costs a few minutes.

Kits in this range ship with two low-frequency antennas on leads. Each defines a detection lobe, and the car unlocks when a valid key is inside either. The installer chooses where those lobes point. The default mistake is mounting both together at the front doors or behind the A-pillar trim, because that is where wiring is easiest — leaving a zone that is narrow, close to the door skin, and easy to reach from outside.

Moving an antenna inboard does not block a relay. It forces the attacker's antenna closer, through more of the body, to pick up the challenge — and a hand-held relay that has to come within arm's length is more conspicuous than one working from a metre away. That is a statement about exposure, not about immunity.

Two rules that matter more than the pattern:

1. Never behind metal. An LF antenna behind a steel bracket or metalised trim is a dead antenna; plastic, foam and cloth are fine.
2. Test the zone after closing the panels. Walk up from four directions with the key pocketed, then repeat with a hand cupped over the key. If the zone changes when the key is covered, it is being read from too far out.

Lever 3 — Sleep behaviour and how the unit is powered

A system that polls forever has a permanent attack surface. Systems that stop transmitting after a period of inactivity — key side, car side, or both — shrink it to the moment the owner is actually approaching.

Two consequences worth raising with the customer:

• Sleep is firmware, not an installation choice. You cannot add it by wiring — only confirm per model whether it exists and prefer models that have it where the parking situation warrants.
• How the control unit is powered affects how long the car can sit armed without flattening the battery. Measured standby figures will be published separately; today the honest answer is "ask us for the measured value for that model", not a datasheet number.

What You Should Stop Doing

Stop quoting "anti-theft" as a specification

"Anti-theft" on a PKE box describes the alarm layer — shock sensor, door trigger, siren — not the entry system's resistance to a relay. Customers conflate the two because we let them. If asked "will this stop my car being stolen", give both halves: the alarm layer makes a break-in noisy; the PKE layer still allows a drive-away if the key is within relay range.

Stop mounting the antenna behind metal trim

The most common installation fault in this category, and invisible once the trim is back on. Symptoms: intermittent no-unlock from one side, fine in the workshop and failing in the car park. When a customer says "it works sometimes", suspect the antenna lobe before the remote battery.

Stop telling customers "it's encrypted, so it's safe"

The sentence that becomes a complaint. Rolling-code encryption defeats recording a code and replaying it later. A relay attack forwards the live exchange in real time instead, so the code stays valid because it is always fresh. Encryption is doing its job — just not the job the customer thinks.

Say instead: "The codes change every time, so nobody can copy your key. What it does not stop is someone extending the range between your key and the car — which is why where you keep the key matters."

A One-Page Handover for the Customer

What to print and give them

Four lines on a card handed over with the invoice: nothing to make, and it prevents the most expensive kind of complaint — the one that arrives after a theft.

1. How to switch PKE sensing off — the exact remote action for their model.
2. Where to keep the key at home — not on a hook by the front door, not on a shelf by a window.
3. What to do when the car sits for weeks — switch PKE off, or keep the key well away.
4. What the system does and does not claim — both halves above, in one sentence.

The sentence that prevents a complaint later

"This system makes the car harder to enter without the key. It does not make the key impossible to extend — so keep the key away from doors and windows at home, and switch PKE off if the car is parked on the street for long periods."

Said at handover and written on the card, it gives the customer an action to take and removes the "you told me it was theft-proof" argument before it exists.

Frequently Asked Questions