A strong password and two-factor authentication on your smart home accounts protect every connected device at once. Physical locks secure one door; compromised cloud credentials can hand control of cameras, locks, sensors and lights to an attacker across your entire home network. Your account login is the single point of failure for the entire system.
Why Your Smart Home Account Is the Master Key
Most smart home devices connect to a manufacturer's cloud service through a smartphone app. That account controls access to cameras, door locks, sensors and other devices.
A compromised account lets an attacker view live camera feeds, unlock doors remotely, disable motion alerts or track your routines. The physical lock becomes irrelevant when someone logs in with your stolen credentials.
Default usernames and passwords are collected and posted online, according to the Australian Cyber Security Centre, leaving devices vulnerable. Attackers use automated tools to try these known combinations across millions of accounts.
The Cyber Security (Security Standards for Smart Devices) Rules 2025 require that consumer devices manufactured after 4 March 2026 ship with unique passwords or force you to define one during setup. Older devices may still use factory defaults.
What Two-Factor Authentication Actually Does
Two-factor authentication (2FA) requires a second proof of identity beyond your password. Even if an attacker steals or guesses your password, they cannot access your account without the second factor.
Common second factors include:
- A six-digit code sent to your phone via SMS
- A time-based code generated by an authenticator app
- A hardware security key that plugs into your device
- A biometric check on your phone (fingerprint or face scan)
Authenticator apps like Google Authenticator, Microsoft Authenticator or Authy generate codes that change every 30 seconds. They work offline and are more secure than SMS, which can be intercepted or redirected through SIM swap attacks.
Hardware keys offer the strongest protection but cost extra and require you to carry them. Most households find authenticator apps strike the right balance of security and convenience.
How Attackers Target Smart Home Accounts
Attackers rarely break encryption or hack the device itself. They target the weakest link: your reused password.
Credential stuffing attacks use username and password combinations leaked from other breaches. If you use the same password for your smart home account and an online retailer that was breached, attackers will try that combination on every major platform.
Phishing emails pretend to be from the manufacturer, claiming you need to verify your account or update payment details. The link leads to a fake login page that captures your credentials.
Some attacks target poorly secured home routers. Once inside your network, attackers can intercept traffic between devices and cloud services or exploit devices with outdated firmware.
Which Smart Home Devices Need Account Protection Most?
Security cameras and video doorbells present the highest risk. A compromised account gives attackers live video feeds of your home interior and exterior, letting them monitor your routines and presence.
The REOLINK E1-2K 4MP Indoor Security Camera connects through the Reolink app, which supports two-factor authentication. Enabling it prevents unauthorised access even if your password leaks in a breach.
REOLINK E1-2K 4MP Indoor Security Camera
Best for: Households seeking an indoor camera for baby or pet monitoring with pan-tilt tracking
Smart locks controlled through cloud accounts create physical security risks. An attacker who gains account access can unlock doors remotely, disable auto-lock features or create new access codes.
Video doorbells combine both risks. The eufy Security Video Doorbell S220 stores footage locally by default but still requires secure account credentials to view recordings and manage settings through the app.
eufy Security Video Doorbell S220
Best for: Households seeking a weather-resistant video doorbell with two-way audio and smart home integration
Indoor monitoring cameras used for pets or children are particularly sensitive. The MUBVIEW 2K Indoor Security Camera for Dog provides two-way audio, meaning a compromised account lets an attacker listen and speak into your home.
MUBVIEW 2K Indoor Security Camera for Dog
Best for: Households wanting app-controlled indoor monitoring with pet detection and two-way audio
Outdoor cameras with spotlights and sirens can be weaponised. The REOLINK Outdoor Security Camera with Spotlight includes motion-activated lighting and alerts; compromised access could disable security features or trigger false alarms.
REOLINK Outdoor Security Camera with Spotlight
Best for: Households wanting outdoor security with colour night vision and smart detection without subscription fees
How to Enable 2FA on Your Smart Home Accounts
Most manufacturers include two-factor authentication in their app settings under security, account protection or privacy sections.
The exact steps vary by manufacturer:
- Open the manufacturer's app and navigate to account settings
- Look for "Two-Factor Authentication", "2-Step Verification" or "Account Security"
- Choose your preferred method (authenticator app recommended over SMS)
- Scan the QR code with your authenticator app if using one
- Enter the six-digit code to confirm setup
- Save backup codes in a secure location
Backup codes let you regain access if you lose your phone or authenticator device. Store them in a password manager or write them down and keep them in a secure physical location separate from your devices.
Enable 2FA on your email account first. If attackers compromise your email, they can reset passwords on all connected services, bypassing individual account security.
What to Do If Your Account Is Compromised
If you suspect unauthorised access to your smart home account, act immediately:
- Change your password from a device you trust (not one that may be compromised)
- Enable two-factor authentication if you had not already
- Review connected devices in your account settings and remove any you do not recognise
- Check for new user accounts, shared access or guest permissions you did not create
- Review activity logs for unauthorised logins or device access
- Contact the manufacturer's support team to report the incident
Manufacturers are required to publish a means to report security issues under the Cyber Security (Security Standards for Smart Devices) Rules 2025, with status updates on resolution.
Change passwords on other accounts that used the same credentials. Update devices on your network to the latest firmware versions, as older software may have exploited vulnerabilities.
Beyond 2FA: Network Isolation for Smart Devices
Account security works alongside network security. Even with strong passwords and 2FA, isolating smart home devices limits what an attacker can access if one device is compromised.
The Australian Cyber Security Centre recommends setting up an additional Wi-Fi network on your router for IoT devices only, which may be labelled as a "guest" network.
This separation prevents compromised smart devices from accessing computers, phones or network storage drives that hold personal data. If a smart plug or sensor is exploited, the attacker remains contained to that isolated network.
If your IoT devices do not require communication between each other, enable the "client isolation" feature. This prevents devices on the same network from discovering or connecting to each other, limiting lateral movement in case of breach.
For more detail on securing cameras when internet access fails, see our guide on keeping security cameras recording when the power or NBN goes down.
Password Managers and Unique Credentials
Using a different strong password for each smart home account eliminates credential stuffing risk. A password manager generates and stores complex passwords you do not need to remember.
Popular password managers include Bitwarden, 1Password, LastPass and Dashlane. Most offer phone apps with biometric unlock, making it as convenient as storing passwords in your browser but far more secure.
A strong password contains at least 12 characters with a mix of uppercase, lowercase, numbers and symbols. Avoid personal information like birthdates, pet names or common phrases.
eSafety recommends updating default usernames and passwords with stronger versions. If you are using a smartphone or device to control smart home devices, ensure they are secured with strong passcodes to protect personal data.
Password managers also store those backup codes you saved when enabling 2FA, keeping everything in one secure vault protected by a single master password.
Do Locally-Controlled Devices Need 2FA?
Some smart home devices operate entirely on your local network without cloud accounts. Zigbee and Z-Wave systems controlled by a local hub do not typically require manufacturer account logins.
These systems still need network security—strong router passwords, WPA3 encryption and network isolation—but 2FA applies to the hub's management interface rather than a cloud account.
Many security cameras now offer local recording to SD cards or network storage without cloud subscriptions. Our comparison of local recording versus cloud subscriptions covers the trade-offs.
Even locally-controlled devices often include optional cloud features for remote access. If you enable remote viewing while away from home, you are creating a cloud account that needs 2FA protection.
What About Smart Locks and Physical Security?
Smart locks create a unique combination of digital and physical security concerns. A compromised account bypasses the lock entirely, but the lock's physical security still matters if someone tries to force entry.
Our guide to smart lock compatibility with Australian doors covers physical installation requirements, but account security determines who can unlock your door remotely.
Some smart locks work with local control only, requiring no cloud account. Others offer remote unlocking through the manufacturer's app, which requires strong password and 2FA protection.
Consider the use case: if you only need automated locking when you are home, local control eliminates cloud security concerns. If you need to let someone in while you are away, cloud access requires maximum account protection.
How Often Should You Update Smart Home Passwords?
Change your smart home account passwords immediately if:
- The manufacturer announces a data breach
- You receive notification of suspicious login attempts
- You shared account access with someone who should no longer have it
- You used the same password on another service that was breached
- You disabled 2FA for any reason and have now re-enabled it
Otherwise, a strong unique password with 2FA enabled does not need routine changing. Forcing frequent password changes often leads to weaker passwords or unsafe storage practices.
Review device access and shared permissions every few months. Remove old user accounts, expired guest access and devices you no longer use.
Manufacturers are required to publish the end of support life (EOSL) period for their smart devices under the Cyber Security (Security Standards for Smart Devices) Rules 2025. When a device reaches end of support, it will no longer receive security updates, increasing risk even with strong account credentials.
Sources
- Cyber.gov.au - Internet of Things devices
- ACCC Product Safety - Smart home devices guide
- eSafety Commissioner - Smart home Gift Guide
- Department of Home Affairs - Factsheet Security standards for smart devices
- Federal Register of Legislation - Cyber Security (Security Standards for Smart Devices) Rules 2025
Comments
Leave a comment