--- title: "How to Protect Your Email for a Home Security System" date: "2026-11-10" author: "Ahsan Luqman" canonical_url: "https://aliasfleet.com/blog/how-to-protect-your-email-when-signing-up-for-a-home-security-system" tags: ["Email Privacy", "Home Security", "Email Aliases"] description: "A monitored alarm account holds the home address and emergency contacts. A dedicated alias, a unique password and two-factor authentication keep it separate." --- # How to Protect Your Email for a Home Security System A monitored alarm account holds the home address and emergency contacts. A dedicated alias, a unique password and two-factor authentication keep it separate. Protecting email for a home security system means giving the monitored alarm account a dedicated alias, a unique password, two-factor authentication, and a tested recovery route. The account holds the home address, the armed state of the system, camera and sensor status, and emergency contacts. A breach of the provider or a leak elsewhere can therefore expose the household, its address and its alarm state, not just an inbox. ## The April 2026 ADT breach In April 2026, attackers accessed ADT systems and took customer data. [Have I Been Pwned](https://haveibeenpwned.com) counted about 5.5 million unique email addresses in the leaked dataset. ADT confirmed that limited customer and prospective customer data was accessed, without confirming a total number, while the attackers claimed more than 10 million records, a figure that ADT did not confirm. ADT stated that no payment information was accessed. It also stated that customer security systems were not affected or compromised. The confirmed scope still mattered: names, phone numbers, emails, and addresses were accessed. Dates of birth and the last four digits of Social Security numbers or Tax IDs appeared in a small percentage of cases. A caller who knows the name, the phone number, and the home address, and who knows the household uses ADT, sounds legitimate. ADT warned customers to stay alert for phishing emails, phone calls, and text messages from people claiming to represent ADT. The [aftermath coverage](https://www.nestorderly.com/adt-breach-aftermath-scam-warnings-october-2026) and the [class action summary](https://openclassactions.com/lawsuits/data-breaches/adt-data-breach-class-action-lawsuit.php) both record the same confirmed scope. A dedicated alias limits exposure to one address used for one service, and a later leak then points to that provider alone. The guide to [checking if an email was leaked](https://aliasfleet.com/blog/how-to-check-if-your-email-was-leaked) explains how to read the results of such a check. ## Contents of the alarm account A monitored alarm account differs from a smart speaker account. The provider holds the monitoring address. It holds emergency contact names and phone numbers. It also holds the live state of sensors and cameras. [ADT help on alerts](https://help.adt.com/article/adt-Smart-Home-Security-Alerts-and-Notifications) describes alerts for burglar, fire, and emergency alarms, for sensors and devices in trouble, and for arm and disarm events, including who armed or disarmed the system. The same address receives the alerts themselves. ADT enrols customers automatically in four system-generated alerts on the default email address. The All Alarms alert requires at least one notification method at all times. An old inbox that is no longer checked receives alerts that nobody reads, and the alarm keeps sounding while the warning sits unseen. The address also carries account information such as permits, billing, and updates. It carries alerts about alarms, troubled devices, camera activity, and custom events such as a door opening. [ADT help on changing the notification email](https://help.adt.com/article/adt-Smart-Home-Security-Changing-Your-Email-Address-for-Notifications) lists those uses directly. The signup email is the address the alarm system talks to, every day, for as long as the system is installed. Alerts, login codes, and password resets all go to the address on the account. A missed alarm alert is the direct result. ## Credential stuffing and Ring The risk sits in reuse, not in the alarm hardware. An email address used at signup often appears on other accounts. One of those accounts leaks. Passwords exposed in that breach are then tried against other services. That method is credential stuffing. The guide to [how credential stuffing works](https://aliasfleet.com/blog/how-credential-stuffing-works) explains the mechanism in full. Ring is an example: in December 2019, attackers reached Ring cameras through credential stuffing and spoke to people through the cameras in their homes. Ring stated that the attackers gained access through credential stuffing. It also stated that no unauthorised access to Ring systems or networks was detected during the attacks on individual customer accounts. Ring then made two-factor authentication mandatory for all accounts on 18 February 2020. Ring President Leila Rouhi said the second layer of verification became mandatory for all users when they log in. Users receive a one-time six-digit code via the email address listed on the account or by text message each time they log in. [BleepingComputer reported the announcement](https://www.bleepingcomputer.com/news/security/ring-forces-2fa-on-all-users-to-secure-cameras-from-hackers/) with that date and that code method. The email address can also lead back to the home. An address that appears in breach data alongside a name can be connected to a home address through data broker records and other public sources. The guide to [whether someone can find a home address from an email address](https://aliasfleet.com/blog/can-someone-find-my-home-address-from-my-email-address) covers that chain. For an alarm account, the connection runs the other way too. Anyone inside the account already has the home address and the alarm state, because both sit in the account record itself. ## A dedicated alias The setup that fits an alarm account is one dedicated email alias, used for the alarm system and nothing else. The alias forwards to a real inbox that is checked daily. Every alert, every login code, and every password reset for the alarm account arrives at that one address. Mail for no other service arrives there. Separation also identifies the source of a problem. If the alias starts receiving spam or appears in a breach, the source is the alarm provider or its supply chain. The alias can then be replaced without touching any other account. That is the same separation used for other signups. The guide to [protecting email when setting up smart home devices](https://aliasfleet.com/blog/how-to-protect-your-email-when-setting-up-smart-home-devices) covers device ecosystems and gadgets rather than a monitored account. This article covers the monitored alarm account, a different account with different stakes. The same principle applies when [signing up for a password manager](https://aliasfleet.com/blog/how-to-protect-your-email-when-signing-up-for-a-password-manager) or [signing up for a VPN](https://aliasfleet.com/blog/how-to-protect-your-email-when-signing-up-for-a-vpn): one alias per service, so a leak in one place stays in one place. One rule for the alarm alias does not apply to aliases for shops or trials. The alarm alias stays live permanently. A shop alias can be paused or deleted when it starts collecting spam. An alarm alias cannot be paused. Pausing it means missing an alarm alert when it matters most. Deleting it means losing the account. The alias is created once, at signup, and kept. ## Passwords and two-factor authentication The alarm account needs a password that is used nowhere else. The [FTC guidance on home security cameras](https://consumer.ftc.gov/articles/how-secure-your-home-security-cameras) advises choosing a strong password that would be hard for a stranger to guess. It advises against using a password that has been used before for another website or account. The same guidance advises looking for two-factor authentication for the cloud account, which requires something in addition to a password, like a verification code sent by email or generated from an authenticator app. Two-factor authentication is now standard on the main alarm providers. On two of them, it is not optional. Ring made it mandatory for all accounts in February 2020. SimpliSafe requires 2-Step Verification on every account. [SimpliSafe support](https://support.simplisafe.com/articles/account-billing/2step-verification-for-simplisafe-accounts) states that it is a required element for a SimpliSafe account and is enabled when the account is first set up. It also states that it cannot be turned off. The email address matters here because the second factor often travels by email. Ring sends its six-digit code to the email address on the account. SimpliSafe sends a device verification email to the account address on any new login, and the user clicks the Verify Device button in it. That happens on any new login, or on a login renewal after about 30 days. If the address on the account is an inbox that is not checked, the login cannot be completed. The guide to [receiving two-factor authentication codes at an email alias](https://aliasfleet.com/blog/can-you-receive-two-factor-authentication-codes-at-an-email-alias) explains how forwarded codes work in practice. Where the alarm provider offers an authenticator app or a security key as the second factor, that option is stronger than a code by email or text. A code sent by email depends on the email account itself. [CISA cyber guidance](https://www.cisa.gov/cyber-guidance-small-businesses) states that any form of MFA is better than no MFA. It states that any form of MFA, like SMS text messages or authenticator codes, will raise the cost of attack and will reduce risk. ## Recovery and household access The recovery path is tested at setup. A password reset for the alarm account goes to the address on the account. If that address is an old inbox, a work inbox from a former job, or an alias that was later deleted, the reset never arrives. The account then cannot be recovered without the provider's help. The guide to [using an email alias for account recovery](https://aliasfleet.com/blog/can-you-use-an-email-alias-for-account-recovery) covers the general case. The alarm account has a sharper version of the same problem, because a missed reset can lock the household out of its own alarm. The account holder signs out of the alarm app and requests a password reset. The reset email should arrive at the alias and forward to the inbox that is checked daily, with no delay beyond normal delivery. The account holder then signs back in and confirms that the login verification code arrives too. That test takes a few minutes. It proves the whole chain: the alias forwards, the inbox receives, and the account can be recovered. Household access belongs in the provider's own sharing feature, not in a shared login. SimpliSafe requires 2-Step Verification on the account email and offers multi-factor authentication through registered phone numbers, as described on [SimpliSafe account security help](https://support.simplisafe.com/en_GB/articles/app-support/securing-your-simplisafe-account). Ring requires the six-digit code for every user on an account, including shared users. One login shared between household members means one password and one email address protecting the whole house, with no separate access for anyone else. It also means no way to remove one person's access without changing the login for everyone. ## Changing the account email Changing the account email later is possible, but the route differs by provider. It is not always self-service. Getting the address right at signup avoids that work entirely. | Provider | Account email change | Notification email change | | :--- | :--- | :--- | | ADT | Contact support through chat for account and marketing email | Change in the ADT+ app or the plus.adt.com portal, under My Profile | | SimpliSafe | Change only through the SimpliSafe Online Account in a web browser, not in the mobile app | No separate notification email; verification goes to the account email | ADT help on changing the notification email gives the ADT routes. [SimpliSafe help on updating an email address](https://support.simplisafe.com/en_GB/articles/account-billing/how-to-update-your-email-address-for-your-simplisafe-account) gives the SimpliSafe route. Other providers differ, and each provider's own help pages give its route. ## AliasFleet and the alarm account AliasFleet provides managed email aliases that forward to a real inbox. An alias created for the alarm system forwards alarm alerts, login codes, and password resets to the inbox the account holder checks daily. The real address is never given to the alarm provider. The alias is a permanent forwarding address, not a short-lived inbox, and it stays active for as long as the alarm system is installed. AliasFleet does not provide the alarm system, the monitoring, or the two-factor authentication on the alarm account. Those remain the provider's responsibility. The alias only protects the email address used at signup. [AliasFleet](https://aliasfleet.com) lists the plans and the free tier on its homepage.