How Distance Bounding Protocols Prevent Relay Attacks During In-Person Meetups

How Time-of-Flight Physics Prevents Signal Spoofing

Time-of-flight (ToF) physics prevents signal spoofing by measuring the exact time it takes for an electromagnetic radio wave to travel between two devices at the speed of light. Because radio waves travel at roughly 30 centimeters (0.98 feet) per nanosecond, any attempt to relay a signal through network cables, cellular towers, or digital processing units adds unavoidable latency. By calculating round-trip delay down to picoseconds, distance bounding protocols mathematically guarantee that two devices cannot be further apart than physics allows.

The speed of light in a vacuum—and roughly in air—is an absolute physical constant ($c \approx 3 \times 10^8$ meters per second). No information or radio wave can travel faster. When Device A transmits a pulse to Device B and demands an instant hardware-level echo, the total round-trip time ($T_{round}$) consists of two components: the time spent traveling through the air ($T_{flight}$) and the time Device B takes to process and return the signal ($T_{process}$).

The mathematical equation governing this distance boundary is straightforward:

$$\text{Distance} \le \frac{c \times (T_{round} - T_{process})}{2}$$

Federal Trade Commission data from 2024 revealed that consumers reported over $400 million in financial losses due to peer-to-peer sales scams. In many of these cases, identity spoofing played a central role. While digital fraud detection flags suspicious logins, physical transaction security requires measuring physical limits.

If a fraudster attempts to relay the signal through a high-speed fiber connection or a 5G cellular link, they introduce physical propagation delay across miles of cable, plus hardware processing delay at every network node. Even if the network adds only 10 milliseconds of latency, that delay corresponds to an extra 3,000 kilometers of physical distance in radio-wave travel time. The distance bounding algorithm instantly detects that the response arrived far too late for the device to be within a 2-meter physical radius, immediately failing the transaction.

Fraudsters cannot bypass this limitation by sending the response early. Because the cryptographic challenge sent by Device A is completely random and unpredictable, Device B cannot guess the response before receiving the challenge. The laws of causality prevent the attacker from answering a question that has not yet been asked.

The Four Cryptographic Phases of Distance Bounding Protocols

Distance bounding protocols execute in four tightly coordinated cryptographic phases—setup, rapid bit exchange, computation, and verification—to measure distance while preventing signal manipulation. During the rapid bit exchange phase, devices swap single-bit challenges and responses under microsecond time constraints where processing delays are forbidden. This strict physical execution ensures that a fraudster cannot guess responses in advance or delay their transmission without triggering an immediate proximity failure flag in the underlying security protocol.

To understand how this protocol operates during an actual transaction, consider the sequence of events that occurs behind the scenes between two smartphones during a physical identity check.

How Distance Bounding Works, Step by Step

1. Phase 1: Cryptographic Setup — Both devices establish an encrypted session using standard public-key cryptography. They generate secret random bitstrings (sequences of 1s and 0s) that will serve as the foundation for the upcoming distance test. No time-critical measurement occurs in this phase.
2. Phase 2: The Rapid Exchange Pulse — Device A generates a series of single-bit challenges ($C_i$) at unpredictable nano-intervals. Device B's hardware controller immediately reflects a single-bit response ($R_i$) calculated using a simple logical XOR operation between the challenge bit and its secret bitstring.
3. Phase 3: Picosecond Time-of-Flight Logging — Device A logs the exact transmission timestamp ($t_1$) and arrival timestamp ($t_2$) for every individual bit using a dedicated Ultra-Wideband (UWB) timer chip. Any single bit that takes longer than a microsecond round-trip is marked as delayed.
4. Phase 4: Cryptographic Verification and Bound Calculation — Device A evaluates the full sequence. It checks that the responses mathematically match the expected cryptographic keys and calculates the maximum upper bound of distance. If the distance exceeds the acceptable threshold (e.g., 3 meters), the session is terminated.

The innovation of this process lies in the separation of the heavy cryptographic math from the rapid exchange phase. Modern encryption like AES-256 requires significant computational processing time, which would introduce variable delays and ruin the time-of-flight measurement. By shifting complex calculations to the setup phase and using single-bit hardware reflections during the rapid exchange phase, processing time ($T_{process}$) is fixed to precise nanoseconds.

If an attacker attempts a "distance fraud" attack—where a dishonest participant tries to pretend they are closer than they really are—or a "relay attack"—where an external eavesdropper re-transmits the exchange—the added delay immediately pushes the calculated bound beyond the physical safety threshold.

Ultra-Wideband (UWB) vs. Traditional Wireless Proximity Tech

Ultra-wideband (UWB) relies on short, nanosecond radio pulses across broad frequency spectrums to achieve precise distance measurement down to centimeters, whereas legacy technologies like Bluetooth Low Energy (BLE), Wi-Fi, and GPS rely on signal strength or external satellites. Signal strength (RSSI) is easily manipulated using power amplifiers or directional antennas to fake physical closeness. UWB distance bounding isolates physical time delay from signal amplitude, making it structurally immune to power amplification and distance-relay spoofing tactics.

Legacy proximity systems were never engineered for security; they were designed for convenience and connectivity. For instance, Bluetooth Low Energy determines distance using Received Signal Strength Indicator (RSSI). RSSI operates on a simple assumption: the weaker the signal, the further away the device. However, a fraudster equipped with a $50 directional antenna and a signal amplifier can boost a weak signal from a block away, making their device appear to sit right next to your phone.

GPS location fixes present a similar security vulnerability. Mobile operating systems read location coordinates reported by the onboard GPS receiver, which can be easily spoofed using software location-mocking tools or low-cost GPS signal transmitters. A scammer sitting in another country can inject fake satellite coordinates into their device software, claiming to stand at a specific street corner in New York.

The following table illustrates how ultra-wideband distance bounding compares against traditional wireless proximity technologies when assessing transaction security during face-to-face meetups:

Technology	Measurement Mechanism	Spoofing Resistance	Latency Overhead	Precision Range
Ultra-Wideband (UWB)	Time-of-Flight (ToF) radio pulse timing	High (Enforces physical laws of light speed)	Sub-nanosecond measurement window	1 cm – 10 cm accuracy
Bluetooth (BLE RSSI)	Received Signal Strength Indicator (Amplitude)	Low (Vulnerable to amplifiers & directional antennas)	100 ms – 500 ms processing lag	1 m – 10 m (Highly variable)
Wi-Fi Fine Timing (RTT)	Round-Trip Time via 802.11mc packets	Medium (Resistant to amplitude tricks, open to OS relay)	1 ms – 10 ms processing lag	1 m – 2 m accuracy
GPS / GNSS	Satellite trilateration signal arrival	Low (Vulnerable to software mocking & SDR spoofing)	1 second update cycles	3 m – 15 m (Fails indoors)

UWB operates across broad frequency spectrums (typically between 3.1 GHz and 10.6 GHz) using extremely short radio energy pulses—often lasting less than two nanoseconds. Because these pulses are so brief, UWB systems easily distinguish between the direct line-of-sight signal and indirect signals that bounce off walls, cars, or buildings (known as multipath propagation). Legacy Wi-Fi and Bluetooth signals suffer from multipath interference, where reflected signals overlap and distort timing measurements.

Integrating Proximity Verification into Combined Identity Scores

Proximity verification acts as an unforgeable physical anchor that validates whether a real device matches the claimed location of an account holder during live interactions. Digital signals like IP addresses or phone numbers can be easily routed through proxy networks or synthetic identities—fake persona files built from leaked personal data. When distance bounding protocol data is merged with digital history, identity-checking algorithms can verify that the physical person holding the phone is genuinely linked to the verified digital history.

Digital signals alone cannot solve physical marketplace fraud. A fraudster can build a convincing online profile using a synthetic identity—a fraudulent persona constructed from a blend of real and fabricated personal data—and back it up with a clean digital footprint. They can route their traffic through local residential proxy IP addresses to appear as if they are browsing from your home town.

To prevent these sophisticated cross-channel scams, safety systems must evaluate both digital legitimacy and real-time physical presence. This is how the TrustCheck combined score uses this signal: by blending the digital identity score—built on historical device risk, network longevity, and record consistency—with the trust score derived from real-time physical proximity proofs.

Consider how these signals interact during a high-value transaction:

• Digital Identity Verification: Evaluates historical signals. It analyzes a device fingerprint—a unique profile compiled from a hardware unit's operating system, hardware configuration, and browser settings—alongside telecom port history—the recorded timeline of when a mobile phone number was transferred across different network carriers—to confirm the account is established and stable.
• Physical Trust Verification: Evaluates real-time spatial reality. It runs a UWB distance bounding check between the buyer and seller at the exact moment of exchange, proving that both account holders are physically present within arm's reach.

If the digital identity score is high (indicating a clean, multi-year identity record) but the physical proximity protocol fails (indicating the signal is being relayed from elsewhere), the combined score drops instantly. This dual-layered evaluation prevents remote fraudsters from using stolen verified accounts to direct local proxies in high-value private sales.

Ensuring Safe Marketplace Meetups Through Physical Proofs

As remote scams continue to pivot toward physical marketplace exchanges, relying on screenshots, digital receipts, or standard Bluetooth connectivity is no longer sufficient. Physical proximity must be verified with the same cryptographic rigor as digital banking passwords.

Distance bounding protocols eliminate the uncertainty of physical meetups by turning the speed of light into an unpassable security barrier. A fraudster can buy stolen credentials, manipulate software locations, or hire local intermediaries, but they cannot force radio waves to travel faster than the laws of physics permit.

By relying on TrustMatch to combine physical distance bounding proofs with deep digital identity analysis, buyers and sellers can conduct face-to-face transactions with complete confidence that the person standing in front of them is genuine, verified, and real.