Checking Your Cameras From Your Phone Without Opening a Door for Hackers
Seeing your cameras from your phone is one of the most useful things a system can do. Done carelessly, it is also one of the easiest ways in for someone who should not be watching. Here is how to keep it useful and locked down.
Use the maker's official app, give every person their own login with a unique password, and turn on two-factor sign-in. Remove people who no longer need access, keep the app and recorder updated, and avoid setups that open a port on your router so the recorder can be reached directly from the internet. Those simple habits close most of the gaps people actually get caught by.
Key Takeaways
- 1Every person who views your cameras should have their own login, not a shared one
- 2Two-factor sign-in stops most attacks that start with a stolen or guessed password
- 3Old users who never get removed are an open door you forgot about
- 4Port forwarding exposes your recorder to the whole internet and should be avoided
- 5Updates matter because they fix holes that are already public
Open your camera app. Now think about who else can open it.
Your manager? The office admin who left last spring? Your nephew who set it up? The installer? Anyone who saw the password on the sticky note by the recorder?
Remote viewing is one of the best things a modern camera system does. You can check on the store at night, see who is at the door, and pull footage from anywhere. But it is also the part of the system most likely to be set up carelessly. Here is how to keep the convenience without leaving the door open.
Use the official app, and only the official app
Your camera system maker has an app. Use it. Avoid third-party apps that promise to work with every brand, especially free ones from unknown developers. You are giving that app your camera login. You want to know who made it.
The official app also tends to connect in a safer way, through the maker's own servers, without anyone needing to change settings on your router. More on why that matters in a minute.
Logins: the part that matters most
One person, one login
The most common setup we see is one login shared by everyone. Same username, same password, on five phones. It feels simpler. It causes real problems.
- When someone leaves, you have to change the password for everyone or leave them with access
- You cannot tell who viewed or downloaded footage
- If one phone gets lost or hacked, every account is exposed at once
- People who only need to see the front door can also see the office and the back room
Most systems let you create separate users for free. Give each person their own. Limit what each one can see. The bookkeeper probably does not need to download footage. A shift manager probably does not need to change settings.
The same goes for the installer. They may need a login to service the system, but it should be their own account, not yours, and you should be able to turn it off when the work is done.
Passwords and two-factor sign-in
Every login needs its own unique password. Not the same one you use for email. Not the factory default. Not the business name followed by 123.
Then turn on two-factor sign-in if your system supports it. That means after typing the password, you also confirm with a code sent to your phone or shown in an authenticator app. Even if someone steals or guesses your password, they still cannot get in without your phone.
If your camera app does not support two-factor sign-in at all, that tells you something about how old or how basic the system is. It is worth asking about during your next upgrade conversation.
Clean out old users
Open the user list on your system. Look at every name. Is each person still with the business? Do they still need access?
Former employees, a past installer, a contractor who needed to see the loading dock for one project. They tend to stay on the list forever because nobody removes them. Make it part of your offboarding: when someone leaves, their camera access goes the same day as their email.
Also look at the phones themselves. Anyone with the camera app should have a screen lock on their phone. A lost, unlocked phone with the app still signed in is just as good as a stolen password.
Keep the app and the recorder updated
Updates are not just new features. They fix security holes that have been found, and once a hole is announced, people who want to exploit it know exactly what to look for.
Phone apps usually update on their own. The recorder and cameras often do not. Find out who is responsible for updating them, and how often it actually happens. If the answer is nobody, that is the first thing to fix.
Why port forwarding is a bad idea
This is the one technical part, and it is worth understanding.
Years ago, the common way to view cameras from outside the building was to change a setting on your internet router called port forwarding. In plain terms, it tells your router: if anyone on the internet knocks on this specific door, let them talk straight to the camera recorder.
Anyone. Not just you. There are automated tools that scan the internet all day looking for exactly these open doors. Once they find one, they try default passwords and known holes in older recorders. If your recorder answers, it has been found.
If someone set up remote viewing by opening ports on your router, have it reviewed. Modern systems connect through the maker's secure cloud service or a private connection instead, so nothing on your network has to be reachable from the open internet.
Keeping cameras on their own separate network is another layer of protection. We cover that in our camera network isolation guide, so we will not repeat it here.
A 15-minute check you can do today
Open the camera app and the admin settings. Go through this list:
- Count the user accounts and remove anyone who should not be there
- Split any shared login into individual accounts
- Change any password that is a default, reused, or written down near the recorder
- Turn on two-factor sign-in for every account that supports it
- Ask whoever set up your system whether port forwarding is in use
None of this requires new equipment. It just requires someone to sit down and do it.
When someone leaves, their camera access should go the same day as their email.
Your Checklist
- Use only the camera maker's official app on every phone
- Give every person their own login and remove any shared accounts
- Set unique passwords and turn on two-factor sign-in
- Review the user list and remove anyone who no longer needs access
- Confirm who updates the recorder and cameras, and when it last happened
- Ask whether your router has port forwarding set up for the cameras
Common Mistakes to Avoid
Sharing one login across the whole team
You cannot remove one person without changing it for everyone, and you cannot see who did what. Individual logins fix both problems.
Leaving former employees and installers on the user list
Every account that should not exist is a way in. Remove camera access as part of every offboarding.
Opening router ports so the recorder can be reached from outside
It makes your recorder visible to automated scanners across the internet. Use the official app and its cloud connection instead.
Assuming the recorder updates itself
Phone apps usually do. Recorders and cameras often do not. Someone has to own that job.
Frequently Asked Questions
Is it safe to view my cameras on public Wi-Fi?
Through the official app with two-factor sign-in, the risk is low because the connection is encrypted. Avoid logging in from shared or public computers, and sign out if you ever have to.
How do I know if port forwarding is set up?
It lives in your internet router settings. If you are not comfortable checking, ask your IT person or your security installer to look. It takes a few minutes.
Can I limit what each person sees?
Most business camera systems let you choose which cameras each user can view and whether they can download footage or change settings. Use it. Most people need far less access than they have.
What if my system does not support separate users or two-factor?
Use the strongest unique password you can and change it whenever someone leaves. Then put a newer system on your list, since missing basics like these usually means other protections are missing too.
Related Services
Want someone to lock down your remote viewing?
We will clean up your users, close open ports, and set up phone access the right way. Serving all 5 boroughs and NJ.