If someone may have accessed your alarm, camera, lock, or smart-home account, treat it as both a digital-security incident and a property-access incident. Preserve evidence, protect people, contain access, rotate recovery and credentials in the right order, inspect devices and automations, then test the entire alarm path. Do not start by factory-resetting everything; that can destroy useful records and make recovery harder.
Account compromise response at a glance
| Stage | Action | Do not |
|---|---|---|
| Safety | Move to a safe place and use emergency services when there is an immediate threat | Enter or confront someone to verify an alert |
| Preserve | Record times, alerts, emails, users, devices, clips, and changes | Delete accounts, clips, or logs in panic |
| Contain | Secure email, carrier, password manager, vendor account, recovery, and sessions | Change only the visible app password |
| Physical access | Rotate alarm codes, lock credentials, mobile keys, and temporary access | Assume a password change removed a door credential |
| Recover | Audit members, devices, integrations, automations, cameras, monitoring, and network | Restore an old backup without checking its access |
| Validate | Run alarm, camera, lock, internet, power, and recovery tests | Declare success because the app opens |
1. Protect people first
If there is evidence of a break-in, stalking, domestic abuse, coercive control, an unlocked door, disabled alarm, or unknown person at the property, prioritize personal safety. Go to a safe location, contact emergency services when appropriate, and follow professional advice. Do not use a camera or lock app to provoke, confront, or trap a suspected intruder.
2. Decide what may be exposed
List the alarm account, camera account, lock account, smart-home platforms, router, Wi-Fi, email, mobile carrier, password manager, authenticator, cloud storage, voice assistant, installer portal, monitoring portal, and billing account. Record whether the suspected access could reveal the address, alarm state, schedules, live video, recordings, door codes, mobile keys, household members, phone numbers, or emergency contacts.
3. Preserve evidence before changing the system
- Write the first known and last known safe times.
- Save security emails, MFA prompts, password-reset notices, new-device alerts, and carrier messages.
- Capture user lists, trusted devices, active sessions, codes, automations, integrations, and device status.
- Export relevant event history and video without editing the originals.
- Photograph unexpected device changes, open panels, moved cameras, damaged sensors, or altered locks.
- Record support case numbers and advice.
Preserve records lawfully and minimize sharing. If the incident may involve crime, abuse, employment, tenancy, insurance, or litigation, ask the appropriate authority or adviser how to handle evidence.
4. Use a trusted device and network
Do not recover the system from a phone or computer that may itself be compromised. Use a patched device you control, preferably on a known network or cellular connection. Check for unknown profiles, remote-management tools, browser extensions, forwarding rules, and active sessions. If the home network is suspect, separate recovery from that network until the router and Wi-Fi are reviewed.
5. Secure the root accounts in order
- Primary email and its recovery methods.
- Mobile carrier account and SIM-transfer protections.
- Password manager and authenticator.
- Apple, Google, Amazon, or other smart-home platform accounts.
- Alarm, camera, lock, router, and monitoring accounts.
Use unique passwords, enable phishing-resistant MFA where available, regenerate backup codes, review recovery email and phone numbers, and revoke unknown sessions. Do not reuse the same new password across the stack.
6. Audit owners, members, and trusted devices
Review owner, administrator, resident, guest, caregiver, installer, landlord, property manager, vendor, and support roles. Remove unknown or unnecessary people. Revoke lost, sold, repaired, or old phones, tablets, browsers, watches, voice assistants, and TV devices. Confirm removed users cannot sign in, view cameras, unlock doors, disarm, change members, or alter billing.
7. Rotate alarm codes and duress credentials
Change master, household, guest, contractor, cleaner, installer, temporary, panic, and duress codes according to the provider’s instructions. Do not test panic, police, fire, medical, or duress functions without approved test mode and monitoring guidance. Check whether codes are shared across keypad, lock, garage, gate, or building systems and rotate each system separately.
8. Rotate every form of door access
| Credential | Containment | Validation |
|---|---|---|
| Mechanical key | Rekey or replace only when physical key exposure is credible and authorized | Test all approved keys and emergency access |
| Keypad code | Delete unknown and shared codes; issue named replacements | Old code fails, new code works, history is correct |
| Phone/watch key | Revoke old devices and wallet credentials | Removed device fails at the door |
| Fingerprint/card/fob | Delete unknown templates or credentials | Revoked credential fails and approved users pass |
| Remote unlock | Review accounts, integrations, and automations | Only named users can unlock remotely |
9. Review cameras, microphones, and recordings
Check members, live-view history where available, downloaded clips, sharing links, storage, retention, privacy modes, audio, camera position, motion zones, and disabled/offline events. Rotate camera credentials and revoke sessions. Inspect whether cameras were moved or turned away. Avoid publishing or forwarding sensitive footage unnecessarily.
10. Inspect integrations and automations
Audit Apple Home, Google Home, Alexa, IFTTT, Matter bridges, Home Assistant, smart locks, garage doors, thermostats, lights, geofencing, webhooks, API tokens, and voice assistants. Remove unknown connections and rotate tokens where supported. Review routines that unlock, open, disarm, suppress alerts, change camera privacy, or depend on presence. Rebuild only the routines you can explain and test.
11. Check router, Wi-Fi, and local access
Change router administration and Wi-Fi credentials when exposure is credible. Update firmware, disable remote administration you do not need, review DNS and port forwarding, remove unknown clients, separate guest and IoT access where practical, and reconnect security devices deliberately. Document which devices fail after the credential change rather than leaving unknown equipment online.
12. Contact monitoring and support
Tell the alarm provider or monitoring service that account or access compromise is suspected. Verify account ownership, verbal password, duress process, monitoring contacts, call order, address, permits, test mode, and any recent support changes. Ask whether the provider can identify new devices, member changes, remote commands, failed sign-ins, or account recovery activity. Record the case number.
13. Inspect physical devices
Walk every hub, panel, keypad, sensor, camera, lock, siren, router, bridge, power supply, backup battery, and communication device. Look for opened covers, missing screws, moved mounts, unplugged cables, unknown USB devices, disabled tamper switches, swapped labels, reset indicators, and unexpected network connections. Photograph anomalies before repair.
14. Run recovery tests
| Test | Pass condition |
|---|---|
| Priority entry | Correct zone, delay, siren, alert, history, monitoring receipt, and response |
| Removed access | Old user, code, phone key, session, and integration fail |
| Camera evidence | Live view, recording, timestamp, storage, and export work day and night |
| Internet down | Local alarm and documented backup behavior match the design |
| AC power loss | Hub, communicator, router, cameras, locks, and siren meet measured runtime |
| Account recovery | Owner can recover without a revoked device or compromised contact |
15. Decide whether to reset or replace devices
Factory reset only after evidence preservation and account control are addressed. Follow the manufacturer’s sequence for removing ownership, unpairing, reset, firmware, re-enrollment, naming, permissions, and testing. Replace a device when ownership cannot be cleared, firmware is unsupported, tampering cannot be ruled out, or recovery depends on an untrusted account.
16. Watch for recurrence
For several weeks, review sign-ins, new-device notices, member changes, resets, lock history, disarms, camera offline events, integration changes, carrier activity, email forwarding, and billing changes. Keep alerts focused so unusual events are visible. Escalate repeated unauthorized access to the provider and relevant authorities.
Incident record
Document the timeline, affected accounts, devices, users, credentials, evidence locations, containment actions, support contacts, physical findings, tests, remaining risk, and next review date. Use the home-security documentation checklist, home cybersecurity guide, and phone replacement checklist to rebuild clean ownership.
Where Abode fits
For an Abode system, review named app users, account recovery, MFA, trusted phones, alarm codes, CUE automations, cameras, locks, integrations, monitoring contacts, plan status, and cellular backup. Use official support for account recovery or suspected unauthorized access. Compare the Smart Security Kit, Abode Cam 2, and current Abode plans.
FAQ
Should I factory-reset every security device immediately?
No. Protect people and accounts, preserve evidence, revoke access, and understand the scope first. Reset devices later when it supports a documented recovery plan.
Is changing the alarm-app password enough?
No. Review email, carrier, MFA, recovery, sessions, users, codes, locks, cameras, platforms, integrations, router access, and monitoring contacts.
What if a former partner or roommate still has access?
Prioritize safety, remove digital and physical credentials, document the change, and seek police, legal, tenancy, or domestic-abuse support where appropriate.
How do I know recovery worked?
Verify revoked access fails, priority alarm events complete the correct response path, cameras and locks work, failures match the design, and account recovery no longer depends on an exposed device or contact.
