homesmartsetup.com | smart home | Amazon Associates | target keyword: are smart locks safe
By the HomeSmartSetup Team
Disclosure: This article contains affiliate links, which means we may earn a commission if you click a link and make a purchase; this does not influence our product testing
As an Amazon Associate I earn from qualifying purchases.
The honest answer is: a well-configured smart lock from an established brand is generally harder to defeat than most people assume, but “smart” introduces attack surfaces a traditional deadbolt simply doesn’t have. Real, published research has found working attacks against commercial smart locks — not theoretical ones. The risk isn’t hypothetical, but it’s also not a reason to stick with a keyed deadbolt by default. What matters is which specific risks are real, which are overstated, and what actually closes the gap.
What security researchers have actually found
The most-cited real vulnerability is the Bluetooth Low Energy relay attack, first demonstrated publicly in 2022 and still relevant to any lock that authenticates a phone by proximity rather than strict physical verification. An attacker uses two pieces of relatively inexpensive radio equipment — one near the lock, one near the owner’s phone — to relay the Bluetooth handshake between them, tricking the lock into believing the authorized phone is physically present when it isn’t. This doesn’t break the underlying encryption; it exploits the trust assumption that “nearby” means “authorized.”
More recent academic work has gone further than relay attacks alone. A 2025 evaluation presented at the USENIX WOOT security workshop tested 18 commercial BLE smart locks and found 14 of them vulnerable to at least one class of attack, across products estimated to affect over 20 million users combined. The vulnerabilities weren’t uniform: some locks transmitted passwords in plaintext over Bluetooth, some were vulnerable to straightforward replay attacks (recording and re-sending a legitimate unlock signal), and — a particularly practical one — some locks let a guest whose access had been revoked simply unlock the door by switching their phone to airplane mode, which prevented the revocation from ever syncing to the lock itself.
Network-layer risks add a separate category entirely. Nuki smart locks were found in independent testing to lack proper SSL/TLS certificate validation, which opened the door to man-in-the-middle interception of network traffic between the lock and its companion app. This class of flaw has nothing to do with Bluetooth proximity — it’s a software implementation mistake, and it’s exactly the kind of issue that a firmware update can fix if the manufacturer is still actively supporting the product.
The vulnerability that isn’t about hacking at all
Kaspersky’s security research team makes a point that’s easy to miss in a headline about “hacking”: a meaningful share of smart lock failures are physical, not digital. Some products pair genuinely capable digital security with weak physical hardware — a fingerprint-scanner padlock with an opening mechanism accessible from outside, for instance, or a lock body that can be pried apart with basic tools. A smart lock’s encryption is irrelevant if the physical housing itself can be defeated in seconds. This is a real argument for sticking with established brands (Schlage, Yale, August, Level) that have both a security research track record and a physical build quality that’s been independently tested, rather than an unbranded budget lock from an unfamiliar manufacturer.
Kaspersky also flags a longer-term risk that’s structural rather than technical: smart locks are expected to last as long as a traditional deadbolt — years, sometimes decades — but IoT devices generally get a much shorter support window than that. A lock whose manufacturer stops shipping firmware updates or shuts down its cloud service stays exposed to any vulnerability discovered after support ends, indefinitely. This is a real factor in which brand to choose, not just which specific model.
Risk by attack type: how each one actually plays out
| Attack type | How real is it | What limits it |
|---|---|---|
| Bluetooth relay attack | Real, publicly demonstrated since 2022 | Requires an attacker physically near both the lock and the owner’s phone simultaneously, plus specific equipment — not a remote, mass-scale attack |
| Replay / airplane-mode access bypass | Confirmed in multiple products in 2025 testing | Affects a subset of tested locks, not all; fixable via firmware if the vendor patches it |
| Man-in-the-middle network interception | Confirmed in at least one major brand (Nuki) | Requires the attacker to already be positioned on the network path; a firmware/TLS fix closes it entirely |
| Weak Wi-Fi network compromise | Real, but it’s a home-network problem, not lock-specific | A weak router password or unpatched router firmware is the actual weak point, not the lock |
| Physical lock-body defeat (prying, bumping) | Real for cheaper/unbranded products | Established brands generally use tested, more resistant lock bodies |
| Lost support / abandoned cloud service | Structural, long-term risk | Choosing an actively maintained brand with a real security team reduces this |
What actually reduces real risk
- Buy from brands with a dedicated security team and an update history — Schlage, Yale, August, and similar established names have published security advisories and shipped fixes for discovered flaws; an unfamiliar budget brand often hasn’t, because there’s no team behind it doing that work.
- Update firmware promptly rather than ignoring app notifications. Most of the specific flaws found in testing (replay attacks, plaintext transmission) are exactly the kind of issue a firmware patch closes — but only for owners who actually install it.
- Use unique access codes per person and delete them the moment they’re no longer needed, instead of one shared code everyone uses indefinitely. A revoked code is only as good as the lock’s ability to actually enforce that revocation, which is the exact flaw the airplane-mode bypass exploited.
- Put smart home devices, including the lock’s hub if it has one, on a separate Wi-Fi network from computers and phones — this limits what a compromised device (lock or otherwise) can reach if it’s ever the weak point.
- Don’t skip the physical side. A lock with excellent encryption but a physically weak housing is still a weak lock — check independent physical-security testing, not just the marketing page’s “bank-level encryption” language.
Verdict: safer than the headlines suggest, but not maintenance-free
A smart lock from an established, actively-supported brand is a reasonable and often more secure choice than a traditional deadbolt for most households — physical lock-picking and bumping are also real, well-documented risks that smart locks can reduce. But “smart” isn’t a synonym for “secure by default.” The real-world vulnerabilities researchers keep finding — relay attacks, replay attacks, revocation bypasses, unencrypted network traffic — are concentrated in specific products and specific failures to patch, not inherent to the category. Treat a smart lock the way you’d treat any other connected device with real consequences if compromised: buy from a brand that takes updates seriously, keep firmware current, and don’t assume “smart” means “install it and forget it.”
FAQ
Are smart locks easier to hack than a traditional key lock?
Not necessarily — traditional deadbolts have their own well-documented weaknesses (lock bumping, picking, bypassing via the door frame itself), and a smart lock from an established brand with active firmware support can be more resistant to physical defeat than a budget mechanical lock. The risk profile is different, not automatically worse.
Can someone hack my smart lock from far away over the internet?
Most confirmed real-world attacks require the attacker to be physically near the lock or on the same local network — true remote, internet-wide hacking of a specific smart lock is much rarer than proximity-based attacks like Bluetooth relaying or local network interception.
Does putting my smart lock on a guest Wi-Fi network actually help?
Yes — isolating smart home devices, including a lock’s hub, from your main network limits what an attacker can reach if that specific device is ever compromised, without meaningfully affecting how the lock functions day to day.
How do I know if my smart lock’s manufacturer still supports it with security updates?
Check the manufacturer’s app or support page for a recent firmware update history — a product that hasn’t received an update in over a year, especially from a smaller or less established brand, is a real signal that known vulnerabilities may go unpatched indefinitely.