A new horror movie trailer recently dropped a scene that made smart-home users uneasy. In it, a stalker appears to unlock every lock in a victim's house through their phone. It felt familiar, and uncomfortable, for anyone who has ditched keys for a smart lock.
We spoke with John Shier, a senior security advisor at Sophos, about the scenario. The short version: it is technically possible. The longer version is more reassuring, but only if you do a few boring things right.
Smart Home Security Checklist
| Action | Priority | Why |
|---|---|---|
| Use unique passwords for smart home accounts | Critical | Breach data can't be reused against you |
| Enable two-factor authentication (authenticator app, not SMS) | Critical | Blocks credential-based access even if passwords leak |
| Delete default device accounts and passwords | High | Default credentials are public knowledge hackers weaponize |
| Run your email through breach lookup sites | High | Reveals exposed credentials tied to your address |
| Unlink smart home from unnecessary social profiles | Medium | Shrinks your attack surface |
| Use a password manager | High | Makes unique credentials practical to maintain |
Key facts
- Cybersecurity Awareness Month coincided with the trailer drop that raised the smart lock question.
- The scenario involves a hacker remotely controlling smart home devices through a compromised account.
- Social engineering plus leaked credentials from data breaches are the realistic entry points.
- An attacker would typically need a specific target rather than picking victims at random.
- Most users are far more likely to be hit financially than physically through these devices.
How a smart lock takeover actually works
Smart locks live inside ecosystems. Your phone app, your cloud account, your Wi-Fi router, and the lock itself all talk to each other. Break any link in that chain and you may end up owning the front door.
The two ingredients that make the movie scene believable are social engineering and credential reuse. A phishing page can be set up quickly to harvest a username and password. Or an attacker can sift through leaked breach data and try those email-and-password pairs against smart home services. Reused passwords turn one old breach into a present-day compromise.
Email is the soft underbelly. Even with unique passwords, your email address alone is enough to start password reset attempts and customer support chats. Combine that with breach data showing which other sites you used, and a patient attacker has a working map.
Why this matters
The point is not that someone will unlock your door tonight. The point is that your smart home runs on the same login you use for shopping, email, and streaming. Attackers don't care which door you give them; they care that one door leads to many.
Compare that to the usual security advice. Most coverage focuses on credit card fraud and identity theft. Smart home takeover sits in a different category: physical-world consequences from a digital foothold. That jump changes the risk calculus for anyone who has replaced keys with an app.
Shier put it bluntly. Criminals want bank credentials and personal data more than your light switches. Physical harm requires targeting, planning, and motive that random hackers rarely bring. The threat is real, but it is asymmetric.
Say you rent a flat full of smart devices
Imagine you moved into a new apartment last year. Smart lock, smart thermostat, a hub that ties them together. You signed up with the same email and password you've used since college, because who has time to remember twenty unique logins?
Here is the practical move. First, change the password on the smart home account to something unique. Use a password manager; this is the one job it was built for. Second, switch on two-factor authentication on that account and your email. An authenticator app beats SMS. Third, run your address through a breach checker like Have I Been Pwned to see if your email shows up in known leaks. If it does, assume that password is burned everywhere it was reused.
Finally, do not link your smart home account to social profiles you do not need. Every linked service is another entry point. Keep the surface small.
What to watch next
Smart home makers will keep adding features and security claims. Watch whether they force two-factor authentication on by default, and whether they support passkeys or hardware security keys. That tells you how much they have thought about this problem beyond the marketing.
Bottom line: the movie scene is not fantasy, but it is not your likely Tuesday either. Treat your smart home login like your bank login. Unique password, two-factor on, and assume any old breach is a key on a hook somewhere.
Key takeaways
- Smart lock takeovers are real but require a targeted attacker, not random hacking.
- Reused passwords and exposed emails are the two biggest realistic risks.
- Two-factor authentication on smart home accounts is non-negotiable.
- Check your email against known breach databases and rotate any reused passwords.
- Default credentials on devices must be changed or deleted immediately.
Frequently asked questions
Can someone really unlock my smart lock from a distance?
It is technically possible if they have your account credentials. Random drive-by hacks are unlikely; targeted attacks are a real risk.
How do attackers usually get smart home passwords?
Mostly through phishing pages and data breach leaks where people reused the same login elsewhere.
Does two-factor authentication stop smart lock hacks?
It blocks most credential-based attacks because the attacker would also need your second factor, which they usually do not have.
Should I avoid smart locks altogether?
Not necessarily, but treat the login like a bank account: unique password, two-factor on, and monitor for breaches.
How do I check if my smart home email is in a breach?
Use a reputable breach lookup service like Have I Been Pwned. If your email appears, change any reused passwords immediately.