How to secure your Alexa device

Tyler Lacoma

Do you know if your Alexa device is always listening? Do you know if a hacker got into your device? Do you know what information your Echo is storing? It’s not just your computer or your smartphone that needs to be secured. Your Echo needs to be secured, too. 

There are a few steps you can take to enhance safety and protect your privacy when using Alexa devices. Choosing a strong password and using a pin for voice purchases are a few examples of security measures you can take.

Delete your Alexa voice recordings every day

On the same day Amazon unveiled the Echo Show 5, it also announced a new privacy feature that allows customers to delete all of their recordings from their Alexa device for a specific day.

If you simply say, “Alexa, delete what I said today,” your Alexa-enabled device will delete your daily voice recordings. If you perform this action at night before you go to bed, you can keep your Alexa recordings cleared out.

Delete your Alexa voice recordings history

Even if you go through and delete you recordings each night, you may still have an archive of past recordings (prior to when you started deleting them daily).

To delete your archive, go into the Alexa app and select Settings > Alexa Account > History, and then go through and delete all of your past recordings.

Turn off your microphone and camera when you’re not using the device

Bill Roberson/Digital Trends

Some users worry about a random creep hacking into their Echo and listening in on them, or even worse, they worry someone may be watching them through an Echo device that has a camera. You can minimize this risk by turning off your microphone if you don’t plan on using your Echo. Simply press the microphone on/off button located on top of the device, and Alexa will stop listening.

You can turn off the camera on all Alexa devices by either using your voice (say, “Alexa, turn camera off”), or you can go to Settings > Device Options and then turn off the Enable Camera option.

In newer Echo models with screens, like the Echo Show 5, Amazon went an extra step and included a physical camera shutter that you can switch over the camera lens. This was done to help assuage fears that digital privacy methods could be overwritten — and also because more new Echo devices were designed for more private areas, like the bedroom.

Be mindful of where you place your Alexa devices

Avoid placing your Echo near a window or in a location that’s easily accessible from outside your home. In addition to reducing the risk of someone accessing your Echo from outside, this also reduces the risk of people outside of your home listening to your calls and other Alexa interactions.

Change your wake word

Change your wake word to a word you seldom (if ever) use in conversation. Also, make sure your wake word doesn’t sound too similar to other words you frequently use in conversation. This way, if you have a friend named Alexis, Alexa doesn’t start recording your conversations when you say your friend’s name.

To change your wake word, you can simply say, “Alexa, change the wake word,” or you can go to the Alexa App and go to Devices > select your device > select Wake Word > select a new wake word from the list > then select OK.

Use a strong Amazon password and two-factor authentication

Sometimes, people forget that their Alexa devices are secured and protected by their Amazon password. If someone has your Amazon password, they have access to your Alexa recordings, your smart devices like security systems and cameras, your daily routine, the ability to make purchases, and much more.

Digital Trend’s own Trevor Mogg recently reported on a study by the U.K.’s National Cyber Security Center (NCSC) that looked at public databases of breached accounts and found that 23.2 million accounts globally used the password “123456.” If you’re using a weak password, or if you’re using the same password for multiple accounts, you may want to think about increasing your password security.

Increase your network security

A secure home network is key to securing your Alexa devices and smart home devices as well. This means having a strong network password, avoiding using default passwords, avoiding giving your password to friends and neighbors (use a “guest” network instead), and using two-factor authentication when possible. You can read more about how to secure your Wi-Fi network here.

Manage smart device connections

Arlo Pro 2 Cheap Home Security Camera

Alexa can connect to smart devices all over your house — in fact, she’s one of the best voice assistants for giving smart devices commands. But all that smart home compatibility also comes with some security concerns. Alexa will receive data about your smart devices and how they are used throughout your home.

Fortunately, just like with Alexa voice commands, there is a way to delete this history of your smart device connections. Just log on to your Amazon account, go to Manage Your Content and Devices, and select Manage Smart Home Devices History. Here you will see an option to delete your devices’ history with just one button.

Set up a pin for voice purchases

One concern a lot of people had with Alexa devices was that kids would accidentally purchase thousands of dollars worth of merchandise, and that we’d all go broke and have piles of Amazon boxes in our living rooms.

While you must have voice purchases “enabled” and you must have a one-click payment method set up to make those voice purchases, it’s still a good idea to take extra precaution and add a purchase code. This requires the purchaser to say a four-digit confirmation code before making any voice purchase. To set up the code, go to the Alexa app and go to Settings > Alexa Account > Voice Purchases. When you enable voice purchases, it will give you the option to set up your purchase code.

Read privacy policies and adjust your privacy settings

Amazon publishes info on its security practices, terms of use, and privacy policies. Review this information so you thoroughly understand Alexa privacy and security, and what type of concerns you should have.

In the Alexa app under Settings > Alexa Account > Alexa Privacy, you can adjust your privacy settings. For instance, you can review your smart alert history, manage which info is sent to Amazon about your smart home devices, and manage your skills permissions (which is kind of like managing app permissions on your phone). Specific Alexa devices have additional privacy settings. For instance, the lets you choose whether or not you want your photos to be submitted for style suggestions.

Manage third-party skills carefully

Third-party Alexa skills are in an interesting position for privacy. On one hand, Amazon doesn’t share any personally identifiable information for any skill without directly asking your permission first. On the other hand, many skills automatically require the transfer of some information. For example, if you start a quiz skill, Alexa is going to send your quiz answers to the skill without asking permission, because that’s what the skill is for.

However, for any contact information, like your email, Alexa can only share it with a skill if that has been enabled. You can go to your skills in the Alexa app and check on your permissions at any time.

Don’t create and share skills that contain your personal information

Alexa Blueprints has given Alexa device users the ability to create, share, and publish their own customized skills. Some of these skills, like personal quizzes and babysitter skills, can contain personal information about the user and their family if the user is not careful.

Before you create a skill (and especially before you share a skill), review it and think about if you’re including too much personal info. Avoid statements in babysitter skills like, “Susie just turned 1 on May 5, so she’s not sleeping through the night yet,” and instead simply say, “The baby isn’t sleeping through the night yet.” In quizzes, avoid including questions like, “When is aunt Jen’s birthday?” Or “What is Uncle Bill’s middle name?” Keep the questions superfluous and fun, without including the wrong kind of personal information.