The Installer Code and Customer Passcode Handling SOP
Purpose
An alarm company holds the keys to every house it monitors, in the form of codes. A panel left on its factory installer code can be reprogrammed by anyone who can look the default up. A master code written on a ticket is readable by every employee and anyone who later gets into the shop's software. A verbal passcode that is never checked lets a caller cancel a real alarm or change the call list. This procedure sets who knows each code, where each one is allowed to exist, how a caller is verified, and what happens the day a code may have leaked, so a complaint about a code can be answered from a record instead of from memory.
Scope
Covers the dealer's handling of installer codes, the customer's master and user codes, verbal passcodes and duress words on residential and light commercial intrusion accounts: setting, storing, verifying, using on service visits, and responding to exposure.
Does not cover key and access-card control at a client's business premises (see related: Keys, Alarm Codes and Access Cards at a Business), the conversation when a customer accuses a tech (see related: A Customer Says a Tech Shared Their Alarm Code), or recovering a takeover panel whose installer code the previous dealer locked (see related: How to Take Over an Existing Alarm System).
Roles and responsibilities
| Role | Owns | Hands off to |
|---|---|---|
| Lead tech | Changing the installer code, entering it in the vault, the master-code handover | Customer, at handover; office, with the vault entry confirmed |
| Office | Caller verification, the weekly ticket scan, offboarding access | Owner, with any exposure |
| Owner | Vault access list, exposure response, the customer conversation | Customer and, where needed, the station |
| Customer | Master, user and duress codes; the verbal passcode with the station | Nobody at the shop |
Who knows what, and where it may exist:
| Code | Set by | Known to | May exist only in |
|---|---|---|---|
| Installer code | Lead tech | Techs assigned to the account | The shop's secured vault |
| Master and user codes | Customer | Customer and their household | The panel |
| Verbal passcode, duress word | Customer, with the station | Customer, station; the office checks a caller's answer in the restricted portal view, never writing it down | The station's account record |
Procedure
Change the installer code from the default on every panel the shop installs or takes over. Before the tech leaves, the installer code is changed to a code generated by the vault (random digits at the panel's maximum length, never derived from the address, account number or a date). Acceptance: the default no longer opens programming, tried once at the keypad, and the new code opens it. Wrong looks like a panel whose programming cannot be entered after the change because the code was mistyped; the stop rule is the tech does not leave until the code in the vault opens programming, tested twice. Hazard: none at this step, keypad work; the panel door is open, so hands stay off the transformer terminals and battery posts.
Store the installer code only in the vault. The vault is the shop's access-controlled password manager or the dealer software's restricted code field, with a login per person and an access log. The code is not written in the panel door, on the ticket, in job notes, in a text or on a sticky note in the truck. Acceptance: one vault entry per account, saved before the job is closed, and the office sees the entry exists without seeing the code. Wrong looks like the code in the ticket's notes "for the next guy"; the stop rule is the office redacts the note the same day and the code is changed at the next visit. Hazard: none, office work.
Hand the master code to the customer and never keep it. If the panel shipped with a default master code or the tech used a temporary one during the install, the customer changes it at handover with the tech looking away from the keypad. Acceptance: the customer arms and disarms with the new master code by their own hand, and the default or temporary master no longer works. Wrong looks like a customer who asks the tech to "just set it to the usual"; the stop rule is the tech explains the shop never knows the master code and waits while the customer chooses one. Hazard: none, keypad work.
Verify the verbal passcode on every call that touches the account. Any call asking to cancel an alarm, change the call list or codes, take the account on or off test, schedule access to the house, or hear account history is verified by asking the caller for the verbal passcode and checking it against the station's record through the dealer's restricted portal view. Acceptance: the ticket notes "passcode verified", with the caller's name, never the passcode. Wrong looks like a caller who knows the address and the customer's name but not the passcode; the stop rule is no change is made and the office calls back the first number on the call list. Hazard: none, a phone call. If the caller gives the duress word, the office does not reveal it and notifies the station immediately as a duress event.
Keep codes out of every written channel. No code of any kind goes on a ticket, a work order, job notes, an invoice, an email or a text, and the office scans the past week's tickets and notes every Monday for 4- to 8-digit numbers next to the words code, master, pin or passcode. Acceptance: the scan done and logged with a count. Wrong looks like a customer who texts their master code to the tech; the stop rule is the tech deletes the text, tells the customer to change that code, and the office records that the customer was told. Hazard: none, office work.
Get in without a code on service visits. The customer disarms on arrival, or creates a temporary user code for the visit and deletes it afterward. Where the panel lets the installer code disarm, the tech uses it only with the customer's consent noted on the ticket. Acceptance: the ticket says how the tech disarmed. Wrong looks like a customer offering their master code by phone; the stop rule is the office asks for a temporary user code instead. Hazard: none, keypad work.
Remove access the day someone leaves. When an employee leaves, vault access is removed that day, their access log for the past 90 days is reviewed, and any installer code they viewed outside an assigned job is changed at the account's next visit or remotely if the panel supports it. Acceptance: access removed with the time, log reviewed, list of codes to change. Wrong looks like a shared vault login that cannot be traced; the stop rule is shared logins are replaced with personal ones and every code under the shared login is scheduled for change. Hazard: none, office work.
Respond to a suspected exposure the same day. If a customer says a tech shared a code, or a code turns up where it should not be, the owner calls the customer that day, has them change master and user codes, has them change the verbal passcode with the station, changes the installer code, and pulls the vault log for that account. Acceptance: every code changed and the log pulled, with the times written. Wrong looks like a reassurance call with nothing changed; the stop rule is the owner does not close the matter until each change is confirmed. Hazard: none, office work.
The record this produces
The vault entry per account and its access log, the ticket line saying how each tech disarmed, the "passcode verified" notes with caller names, the Monday scan log, offboarding records, and the exposure response with its times. The owner reads the access log and the scan log monthly; the record answers a customer who asks who could have known their code.
A worked pass
Step 1, install day. The default installer code no longer opens programming; the vault-generated code opens it twice. Pass.
Step 3. The customer sets a master code with the tech looking away, arms and disarms. Pass.
Step 4 triggers its stop rule, Thursday. A caller gives the customer's name and address and asks to remove the second call-list contact, an adult son, and add a new number. Asked for the verbal passcode, the caller says the customer set it and they do not know it. No change is made. The office calls the first number on the call list; the customer answers, gives the passcode, which matches the station's record in the portal view, and says the request was from a relative they had not authorized. The ticket reads "change refused, caller could not verify; customer verified by callback, no change wanted", with no passcode written anywhere. That is the step working, not failing: the stop rule fired on the case it exists for.
Step 5's scan catches a breach, the following Monday. The office scan of 41 tickets finds one hit: a different account's service ticket reads "cust gave master code" followed by 4 digits, typed by a tech who used the code to disarm. Step 6 had been skipped as well. Stop rule taken: the note is redacted that day, the owner calls the customer, and the customer changes the master code and creates a separate user code for future visits. Step 8 runs in part: the vault log for that account shows only the assigned tech, so the installer code is left as is, and the record says why.
The coaching line on the ticket: the tech is shown step 6 and the temporary user code is added to that account's service notes as the way in. What the scan cannot catch is a code written in words or split across two notes, which is why step 5's rule is about every written channel and the scan is only its check.
References
- See related: Keys, Alarm Codes and Access Cards at a Business
- See related: A Customer Says a Tech Shared Their Alarm Code
- See related: How to Take Over an Existing Alarm System
- See related: The Monitoring Activation and Account Onboarding SOP