How to Stop Your Security Camera Being Hacked

A security camera is only as private as the account behind it. If you have just bought one, or you have had one running for years without touching the settings, the first job is to change the default password before anything else. The National Cyber Security Centre is blunt about it: if your smart device comes with a default password, like 0000, change it immediately¹. Police Scotland adds that a smart device without a strong password or regular updates is more likely to be hacked².

After the password, three things do most of the work. Turn on two-step verification for the camera app and its account, so a criminal who learns your password still cannot get in³. Keep the camera's firmware up to date, because updates fix the flaws attackers rely on⁴. And secure the home Wi-Fi the camera sits on, including the router's own administrator password⁵.

None of this is difficult, and most of it takes minutes. What follows sets out each step in the order to do it, how to tell whether someone has already got in, and what to do if they have.

Change the default password before anything else

Every camera arrives with a factory password, and those passwords are published in manuals and shared online. The National Cyber Security Centre's instruction is to change it immediately¹. Do this before the camera is mounted, before it is connected to your Wi-Fi, and before anyone else in the household is given access.

A strong password for a camera account should be unique to that account. Police Scotland advises avoiding repeated passwords for different accounts⁷, and warns that a password should be unique to you to avoid identity fraud⁸. The practical way to manage this is a password manager, which remembers long, different passwords for you. If you use one, switch on two-step verification on the password manager account itself, so that a criminal who knows the primary password still cannot reach the rest⁹.

Your router needs the same treatment. Secured by Design, the police crime prevention initiative, advises changing the default administrator credentials for the router settings and the issued Wi-Fi password, and using WPA2 encryption⁵. A camera on a network with the router's factory password is exposed no matter how good the camera's own password is.

• Camera account: a new, unique password, not reused anywhere else⁷
• Router: new administrator credentials and a new Wi-Fi password, WPA2 encryption on⁵
• Password manager: two-step verification switched on for the manager itself⁹
• Written record: keep any recovery codes somewhere locked away, not on the camera app

If several people in the house need access, give each their own account rather than sharing one login. That way, removing someone's access does not mean changing the password for everyone.

Turn on two-step verification for the camera app and account

Two-step verification, also called two-factor authentication or 2FA, is the single most effective protection after a strong password. Avon and Somerset Police describe it as an extra layer of security that asks for more information to prove your identity before letting you into your account³. The National Cyber Security Centre explains that it gives you a code to enter from an app or SMS, so that even if a criminal knows your password, they will not be able to access your accounts¹.

Police Scotland's advice is to turn on 2FA or multi-factor authentication for all devices and accounts⁷. For a camera, that means the app account you use to view the feed, and any manufacturer account tied to the device. The National Cyber Security Centre lists turning on 2SV for your most important accounts among its top tips for staying secure online¹⁰.

The usual method is a code sent by SMS or email, or generated by an authenticator app⁶. Whichever your camera app offers, set it up before you rely on the camera. Keep the recovery codes somewhere separate from the phone you use to view the feed, so that losing the phone does not lock you out of your own account.

Keep the camera's firmware up to date

Camera firmware is the software built into the device. Manufacturers issue updates to close security flaws, and attackers depend on householders ignoring them. Essex Prepared, quoting national cyber security advice, puts it plainly: software and app updates contain vital security updates to help protect your devices from cyber criminals⁴. The same guidance notes that hackers rely on you to ignore those update notifications so they can get in before the update is made⁴.

The Royal National Institute of Blind People makes the same point in its online safety guidance: hackers often use outdated software to hack devices, and updates fix known security issues and add new security features¹¹. The National Cyber Security Centre's recovery guidance says to apply updates to your apps and device software as soon as they are available, because updates include protection from viruses⁶.

Some cameras build checks into the update process itself. Ajax, for example, states that its IndoorCam has protection against firmware spoofing and a secure automatic firmware update¹². That helps, but it does not remove the need to install updates when they arrive.

• Turn on automatic updates in the camera app if the option exists
• Check monthly for firmware updates on the camera and its hub or recorder
• Update the app on your phone at the same time, not weeks later
• Replace, do not ignore, a camera the maker has stopped supporting

That last point matters. Which? records that Yale lists a software update period of four years after the end-of-sale date for its Smart Indoor Camera, and that the Nest Cam Indoor 3rd Gen (Wired) has a software update period until at least January 2030¹³. When a maker stops issuing updates, the camera stops receiving security fixes. Our guide to how long cameras and doorbells get software updates explains how to check a model's support period before you buy.

Secure the home Wi-Fi the camera connects to

A Wi-Fi camera is only as safe as the network it joins. Reolink describes its Wi-Fi indoor cameras as connected to your home or office Wi-Fi network, powered from a nearby wall outlet via an adapter¹⁴. That means anyone who gets onto your Wi-Fi can potentially reach the camera, so the router is part of the camera's security.

Secured by Design's advice covers the essentials: change the default administrator credentials for the router settings, change the issued Wi-Fi password, and use WPA2 encryption⁵. Do this once, and every device on the network benefits.

A few practical points follow from this. Put the camera on your main home network only if the router is secured; a guest network isolates it from your computers but may limit app features. Keep the router's firmware updated as well as the camera's. And if your broadband is slow or unreliable, think carefully before choosing a camera that depends on the cloud, because the National Cyber Security Centre notes that cloud storage requires a reliable internet connection and is not suitable if yours is slow, unreliable or metered¹⁵.

Most wireless security cameras are plugged into the mains, with a few offering some back-up battery time in case of power failures¹³. A power cut therefore takes most cameras offline, which is a reliability question rather than a security one, but it is worth knowing before you rely on one.

Local storage or cloud storage: what each means for privacy

Where the footage goes decides who can reach it. A camera that records to a card or a recorder in your home keeps the footage under your roof. A camera that records to the cloud sends it to the manufacturer's servers, reachable from anywhere with the account login.

Which? sets out the difference model by model. It lists the Yale Smart Indoor Camera as offering local storage, cloud storage for a subscription, motion detection, customisable privacy zones, and a software update period of four years after the end-of-sale date¹³. The Nest Cam Indoor 3rd Gen (Wired) has no local storage, cloud storage for a subscription, motion detection, and a software update period until at least January 2030¹³.

Neither is automatically safer. Cloud storage keeps a copy if the camera is stolen, but it widens what a compromised account exposes. Local storage keeps footage in the house, but a thief who takes the camera takes the card. The National Cyber Security Centre's caution about unreliable connections is the deciding factor for many rural households¹⁵. Our guide to cameras that record without the internet covers the local-only options in more detail.

Signs your camera may have been hacked

Camera intrusions often show up first as small oddities. The National Cyber Security Centre lists the signs of unauthorised activity on an account: changes to your security settings, messages or notifications sent from your account that you do not recognise, logins or attempted logins from strange locations or at unusual times, and unauthorised money transfers or purchases⁶.

Translated to a camera, watch for:

• Settings you did not change, such as motion alerts switched off or privacy zones moved⁶
• Notifications you did not trigger, or alerts arriving when nobody is home
• The camera moving on its own, where it has pan and tilt
• Login alerts from places or times that do not match your use⁶
• A password that no longer works, or a reset email you did not request

Some of these have innocent explanations. A camera that reboots after a firmware update may reset a setting, and a shared household account will show logins you did not make yourself. Check with everyone who has access before assuming the worst.

What to do if someone has got into your camera

Act in order. The National Cyber Security Centre's recovery guidance starts with the password: change the password for the hacked account immediately, and change the password for any accounts where you use the same password¹⁶. Then force all devices and apps to log out, usually from the Settings menus of the app or website, so that anyone attempting to use the account is prompted to supply the new password⁶. Set up two-step verification if it was not already on⁶.

Police Scotland's advice for a hacked account is to follow the National Cyber Security Centre's recovery steps, read how to protect the account from future hacks, and follow its own guidance on what to do when an account is hacked¹⁷. Avon and Somerset Police advise checking your account settings for unauthorised changes, enabling 2SV if it is not already on, and reporting the compromise to Report Fraud³.

For the device itself, Police Scotland advises resetting it to factory settings and asking the manufacturer what extra steps to take². A reset clears any changes an intruder made, but it also wipes your settings, so note your configuration first.

1. Change the camera account password, and any account that shared it¹⁶
2. Force all devices and apps to log out⁶
3. Turn on two-step verification⁶
4. Reset the camera to factory settings²
5. Ask the manufacturer what else to do²
6. Report it: to the police, and to Report Fraud³

If the intrusion involved someone watching or recording inside your home, treat it as a police matter. In Scotland, Police Scotland's own hacked accounts guidance is the route¹⁷; our guide to reporting crime and getting support in Scotland and Northern Ireland sets out how the arrangements differ from England and Wales.

Cameras, neighbours and the law

A camera that records beyond your boundary raises questions that go past account security. Avon and Somerset Police warn that once you share an image, you lose control of who can see it and may be breaking the law¹⁸. That applies to footage of a neighbour's garden or a public street as much as to a family photo.

Police Scotland advises putting a camera 3 metres above the ground, because it is more likely to record faces and stops thieves from breaking the camera¹⁹. Height also affects what the camera sees over a fence. If a neighbour's camera overlooks your home, raise it with them first; our guide to filming beyond your boundary explains the data protection rules that apply to domestic CCTV.

For the wider picture on choosing and siting cameras, see home cameras and CCTV, and for the account side specifically, camera and doorbell accounts.