Are smart locks safe? What the real risks are

Two kinds of risk: the door and the account

A smart lock adds a digital door to a physical one. The physical part decides whether someone can kick, pick or bump the door open. The digital part decides whether someone can log in, borrow a code or trick a phone. Most real-world problems come from the physical side and from weak accounts, so fix those first.

The hardware: grade, cylinder and frame

Look for an ANSI/BHMA grade. Grade 1 is the highest tier, built for heavy use and security; Grade 2 is described as excellent for most residential applications; Grade 3 is the minimum acceptable for residential locks. The grade comes from testing and covers operation, durability, strength, security and finish. A smart lock with a lower grade than your old deadbolt is a downgrade.

• Cylinder. A standard pin-tumbler keyway can be picked or bumped. A cylinder advertised as pick- and bump-resistant raises the effort needed. Do not rely on a keyway you cannot verify.
• Bolt throw. Police crime-prevention guides recommend a deadbolt that extends at least 1 inch into the frame.
• Frame and strike plate. A kick can split a frame held by short screws. These guides suggest strike plate screws about 3 inches long that reach the wall stud, and a plate at least 4 inches long.
• Door. A hollow or weathered door is a weak point whatever lock you fit.

Our front door security kit adds the strike plate and screws that matter most.

The account: passwords, two-factor and shared access

Your lock’s cloud account is a second key. The FTC advises a unique password for each device account, two-factor authentication, regular updates and turning off features you do not use. CISA notes that even if a password is compromised, an attacker cannot meet the second step and cannot get into the account.

1. Use a unique password and a password manager for the lock account.
2. Turn on two-factor authentication, and keep your recovery email secure.
3. Review the access list every few months: remove old guests, ex-roommates and expired contractors.
4. Use time-limited codes for visitors and delete one-time codes after use.
5. Check the activity log for entries you do not recognize.

Auto-unlock, Bluetooth and relay tricks

Auto-unlock opens the door when your phone is near. It is convenient but trusts a signal. Proximity can misfire when you are inside near the door, and a signal can in theory be relayed from a distance. If you use it, enable it only for the entry you want, add a short delay and require the phone to be unlocked. Many people switch it off and use a keypad or a tap instead. It is the feature most worth reviewing in your settings.

Updates, networks and standards

Install firmware updates, which fix security bugs. Put the lock on a separate network if your router allows it; how to set up a separate smart home network explains how. Matter locks work across ecosystems and are designed for local control over Wi-Fi or Thread, with Bluetooth for setup; the standard is maintained by the Connectivity Standards Alliance. NIST publishes baseline cybersecurity guidance for consumer IoT devices, and the FTC’s advice above applies to any brand.

What actually reduces risk most

Nothing is risk-free. Rules and insurer conditions differ, and a smart lock does not replace common sense. For battery planning, see what happens when a smart lock battery dies.