The Immobilizer Cut Car Theft Far More Than Rolling Codes

The rate of vehicle theft in the United States declined by 80% between 1990 and 2020. A 2025 study in Security Journal analysed Federal Register data and concluded that the electronic engine immobilizer caused this decline. Not the key fob. Not the rolling code. The immobilizer.

That finding is worth sitting with, because the key fob gets most of the attention in conversations about car security. You press a button, the car unlocks. You walk away, it locks. The rolling code inside it changes with every press, which sounds secure. And it is, for one specific threat. But the rolling code is not what stopped car theft from being routine. The immobilizer is.

The immobilizer cut car theft by 80%, not the rolling code

The Security Journal study published in January 2025 is the most comprehensive analysis of the immobilizer’s effect to date. It compared vehicles with electronic immobilizers against a matched control group and found an 80% decline in theft for the immobilised vehicles. The study also found that theft of new secure vehicles declined before older vehicles, which is the pattern you would expect if the immobilizer were the cause.

The immobilizer works differently from the key fob. It is a small transponder embedded in the key, and a reader near the ignition or start button. When you insert the key or press start, the reader sends a challenge. The transponder answers with a cryptographic response. If the answer is wrong, the engine control unit will not start the engine. No fuel, no spark, no drive-away. The immobilizer was introduced in the mid-1990s and became standard equipment across most of the industry by the early 2000s.

What rolling codes actually prevent

Rolling codes, also called hopping codes, were developed to solve a specific problem with earlier remote keyless entry systems. The earliest systems used fixed codes. Every time you pressed the button, the fob sent the same signal. An attacker could record that signal with a cheap radio receiver and replay it later to unlock the car. A 2001 article in Design News describes the vulnerability plainly: early remote-entry systems suffered from exactly this weakness.

Rolling codes fixed it by changing the transmitted code with every button press. The key fob and the car share a secret key and a counter. Each press increments the counter, and the transmitted signal is an encrypted version of that counter. The car checks whether the counter is in the expected range, and if it is, it unlocks and increments its own counter. A 2024 paper in ACM Transactions on Cyber-Physical Systems explains that the rolling code scheme was designed to prevent an attacker from inferring the next valid signal by capturing the previous one.

So rolling codes stop replay attacks. That is their job, and they do it well. The problem is that replay attacks are not the main way cars are stolen today.

Relay attacks bypass the fob entirely

A relay attack does not record, decrypt, or replay anything. It extends the range of the signal. The car sends a low-frequency challenge, around 125 kHz, that is deliberately short-range. The key fob answers on a UHF band. A relay attack places one device near the fob and another near the car, and stretches the conversation across the distance.

A 2011 paper by researchers at ETH Zurich published the definitive teardown of this attack. Their relays worked across 10 car models from 8 manufacturers, and they were independent of the modulation, protocol, or presence of strong authentication and encryption. Relaying the signal in one direction only, from car to key, was enough. The tested distances went up to 50 metres through walls, with the fob excitable from as far as 8 metres. Fifteen years later, that is still the attack. The equipment just got cheaper.

A 2026 Yahoo Autos article explains why rolling codes do not help here. The security model rests entirely on the low-frequency challenge being weak enough that only a fob within a metre or two can hear it. Distance is the authentication. Everything else, including rolling codes and AES encryption, is doing its job perfectly while the car makes a completely wrong assumption about where you are standing.

CAN injection bypasses both the fob and the immobilizer

A relay attack still requires the key fob to be present, even if it is inside your house. A CAN injection attack does not. It bypasses the key fob and the immobilizer entirely by injecting messages directly into the vehicle’s internal communication network.

The attack was documented in detail by Ken Tindell of Canis Automotive Labs after a friend’s Toyota was stolen. Thieves accessed the Controller Area Network through the headlight wiring, then injected frames that impersonated the smart-key ECU. The vehicle believed a genuine key was present, disabled the immobilizer, and allowed the engine to start. A 2026 Yahoo Autos article on the Toyota theft epidemic in Australia describes the method: criminals use devices disguised as Bluetooth speakers, purchased on the dark web, to inject false messages into the CAN bus. The entire process takes under two minutes and requires no key fob at all.

What to look for in your next car

The relay attack has a technical fix, and it is called ultra-wideband. UWB measures the time of flight of the signal to determine the key’s actual distance from the car. A relayed signal takes measurably longer, so the system recognises the deception and stays locked. ADAC, the German motoring organisation, found in its 2026 testing that only about 20% of the models it has tested from brands like Dacia, Ford, Hyundai, Kia, and Toyota offer adequate protection. UWB adds only marginal cost, according to ADAC, yet many manufacturers still do not include it as standard.

When you see a car advertised with UWB keyless entry, it means the manufacturer has addressed the relay attack at the physical layer. When you see a car without it, the rolling code in the fob is irrelevant to the most common theft method in use today. The rolling code was never the defense that mattered. The immobilizer was, and now even the immobilizer is being bypassed by attacks that have nothing to do with the key fob.