Are smart locks really safe? What Australian homeowners need to know
Smart locks have shifted from niche gadget to mainstream fixture in Australian households. Bunnings stocks Yale, Lockwood and Samsung models alongside traditional deadbolts, and the pitch is simple: ditch the keys, unlock from your phone, hand out codes to tradies.
The shift mirrors broader home trends. With NBN-connected households now standard across Sydney, Melbourne and Brisbane suburbs, the infrastructure for remote-controlled door hardware is essentially universal. Several insurers now include smart locks on their approved security device lists.
What separates a genuinely secure lock from a compromised one is rarely obvious from the box. Behind the touchscreen sits a small computer running firmware, talking over wireless protocols, and storing credentials that may be extractable.
How smart locks actually function
Most smart locks are motorised replacements for an internal bolt, combining an actuator, a wireless radio, a credential reader, and firmware that brokers access. Communication runs over Bluetooth for short-range control, Wi-Fi for remote access, or mesh protocols like Z-Wave and Zigbee through a hub.
The credential pipeline is where the security work happens. A fingerprint template is stored as a hashed representation rather than an image. A PIN is validated locally, while cloud-issued codes travel encrypted through the manufacturer's servers. Weakening any link in that chain exposes the rest.
| Lock Type | Connection | Credentials | Strength | Weakness |
|---|---|---|---|---|
| Bluetooth keypad | Bluetooth | PIN code | Works offline | Limited remote control |
| Wi-Fi smart lock | Wi-Fi | App, PIN, sometimes biometric | Full remote access | Depends on router uptime |
| Biometric lock | Bluetooth/Wi-Fi | Fingerprint, PIN | Hard to share fraudulently | Sensor spoofing risk |
| Z-Wave/Zigbee | Mesh hub | App, PIN | Low power, stable mesh | Requires hub |
Common attack vectors researchers have found
A pattern of weaknesses has emerged over a decade of research. Relay attacks capture the Bluetooth handshake by amplifying the signal, tricking the lock into opening. Replay attacks record an unlock command and rebroadcast it. Credential stuffing reuses passwords stolen from unrelated breaches against the companion app.
Physical bypass remains a real risk. Several consumer-grade models have been opened with shim tools, plastic cards, or strong magnets. The motor can usually be defeated by removing the cover plate and applying voltage directly, which is why reputable designs include tamper sensors that freeze the firmware after repeated failed attempts.
Firmware hygiene matters as much as hardware. Much like phone owners periodically need to update WhatsApp safely to keep data protected and avoid losing chat history, smart lock users should treat the device like any connected product and apply patches promptly.
Australian usage patterns and market realities
Adoption in Australia has been steady, partly because insurance discounts for monitored alarm systems are well established here. Many newer apartments in inner Sydney and Melbourne now ship with smart access as standard, controlling not just the front door but parcel lockers and intercom routing. Suburbs like Adelaide's inner east tend toward Bluetooth retrofits, sidestepping NBN dependency.
Brands with an Australian presence, including Lockwood, Yale and Schlage, typically maintain local firmware release notes and customer service. White-label models sold through online marketplaces rarely receive sustained software support after the first year, which has prompted several state consumer affairs offices to publish advisory notices.
Australian insurers don't require a specific certification before recognising a smart lock for premium purposes. They do look for documented encryption, tamper-resistant housings, and multi-factor authentication, and buyers who can point to those features in writing have fared better in forced-entry disputes.
Encryption standards that actually matter
Marketing copy tends to advertise "bank-grade encryption", a phrase that says little on its own. The meaningful test is whether the device uses AES-128 or AES-256 for stored credentials, whether transport between lock and cloud runs TLS 1.2 or higher, and whether cryptographic keys live in a secure element.
Two-factor authentication on the companion app is now baseline. Biometric verification of the homeowner before issuing a remote unlock command reduces the impact of a stolen phone password. Reputable manufacturers publish third-party penetration test summaries, and the absence of such documentation is itself a signal.
There is no Australian equivalent of the German AVS or French ANSSI certification for connected locks, though the Australian Cyber Security Centre has published consumer guidance that aligns with UK and US frameworks.
Privacy and data handling concerns
Smart locks generate steady metadata: who arrived, when, which credential, from which network. That information is valuable to manufacturers building usage analytics, and occasionally to law enforcement through court orders. Where the data lives varies dramatically between brands.
Australia's Privacy Act and the Australian Privacy Principles place obligations on manufacturers above the small-business turnover threshold, though enforcement is uneven for global brands operating through resellers. Owners who care should read the privacy policy before purchase, paying attention to retention periods, third-party sharing, and whether a local-only mode exists.
Broader innovation coverage can help frame individual product decisions within larger industry patterns as the sector evolves.
Power, connectivity and physical failure modes
Every smart lock eventually runs out of battery, loses Wi-Fi, or freezes at an inconvenient moment. The best designs treat these as routine. A low-battery warning weeks in advance, a mechanical key override using a standard cut, and a manual thumbturn on the inside for emergencies are now hallmarks of a mature product.
Cloud-dependent locks suffer when the home network drops, which on the NBN can happen during maintenance windows or extended outages. Bluetooth-only models keep working through router failures but lose remote PIN-issuing capability. Neither is ideal, and the choice depends on which failure mode a homeowner can tolerate.
Practical steps owners can take right now
Change the default PIN the moment the lock is installed, and never reuse passwords from other accounts for the companion app. Enable every available second-factor option. Check the manufacturer's firmware release history before purchase — a model receiving three or more updates in the past year has a maintenance team behind it.
Mount the lock's interior away from letterbox openings and accessible windows, since real-world burglaries have exploited reach-in attacks on the thumbturn. Keep the mechanical key somewhere secure but accessible, ideally with a trusted neighbour rather than under a doormat. Review the activity log monthly, treating unusual entries with the same suspicion as unfamiliar bank transactions.
A smart lock is neither inherently secure nor inherently unsafe. Properly installed, regularly updated models from established manufacturers offer protection matching a quality traditional deadlock, particularly against opportunistic entry. What undermines them is almost always owner behaviour: default credentials, deferred updates, and an assumption that an app icon replaces disciplined security hygiene. Treat the device as the connected computer it actually is, and the front door stays as secure as the network supporting it.