Lock Bumping in NYC: How It Works and Which Locks Stop It

A few years back a YouTube video made the rounds: a teenager in his garage takes a regular house key, files the teeth down with a Dremel, slides it into his front door, gives it a few sharp taps with a screwdriver handle, and the door opens. Total time, maybe 8 seconds. Reaction in the comments: panic.

The technique is real. The panic is mostly overdone. Lock bumping is a niche attack vector in NYC break-ins, well behind the much more common patterns (door kicked, window pried, social-engineered "FedEx delivery"). But it is real, the tools cost $12 to assemble, and most apartments are protected against it by accident rather than design. So it is worth understanding.

Here is what bumping is, what it actually opens, and which $80 upgrade ends the conversation.

How a bump key actually works

A standard pin-tumbler lock (which is what almost every American house, apartment, and storefront uses) has a row of spring-loaded pin stacks sitting above the cylinder plug. When you insert the right key, the cuts on the key push each pin stack up to exactly the right height so the split between the upper and lower pins lines up with the shear line between the plug and the lock body. The plug rotates. The bolt retracts.

A bump key is cut to "all-nines," meaning every cut on the key is filed to the maximum depth. When you insert this key partway, pull it back one click, and strike the head sharply, the impact transmits through the pins. The upper pins are knocked up away from the lower pins. For a fraction of a second, every pin stack is split at the shear line. If you apply slight rotational pressure to the key at the moment of impact, the plug spins and the lock opens.

It is a physics trick, basically a Newton's-cradle problem applied to a lock. With practice the success rate on a standard hardware-store deadbolt is around 70-80%. On a $20 doorknob lock, closer to 95%.

Two things kill the attack:

1. Pins that do not separate cleanly under impact (security pins, spool pins, serrated pins).
2. A keyway that the bump key cannot physically enter (restricted keyways).

Almost everything else is theatre.

Which locks bump open easily

The brutal honest list, based on what locksmiths see when they get called for a "the lock turned but I never gave anyone a key" job:

• Kwikset Smart Key residential deadbolts. The factory pin design is famously bumpable and pickable.
• Defiant, Brinks, and other big-box generic deadbolts. No security pins, wide keyways, common pin counts.
• Older Schlage F-series knob locks without security-pin upgrades. The newer ones improved.
• Most apartment doorknob locks, which were never designed as primary security.
• Mailbox locks. Most are wafer locks rather than pin tumbler, but the wafer equivalent of bumping (raking) is faster.

If a lock cost less than $40 at Home Depot and was installed before 2010, assume it is bumpable.

Which locks do not bump open

The locks that resist bumping all do one of three things:

Security pins. Schlage Primus, ASSA Twin, and most modern commercial-grade locks use mushroom pins, spool pins, or serrated pins. When the bump impact tries to separate the pin stack at the shear line, these pin shapes catch on the shear line and refuse to move cleanly. A practiced bumper can sometimes still get past them, but the success rate drops from 80% to under 10%, and the time goes from 8 seconds to several minutes of audible tapping at your door.

Restricted keyways. Medeco, Mul-T-Lock, Abloy Protec, ASSA d12, and a handful of others use key blanks that have unusual cross-sections or sidebar requirements. A standard bump key cannot physically enter the keyway. You can read more on these in our high-security locks NYC breakdown and the Medeco vs Mul-T-Lock NYC comparison once it goes live.

Disc-detainer or magnetic mechanisms. Abloy uses rotating discs instead of pin tumblers. There is no pin to bump. These locks ignore the attack entirely. They are also expensive ($350-$500 installed) and overkill for most apartments, but worth knowing.

The cheapest upgrade that actually defeats bumping is a Schlage Primus deadbolt or a Mul-T-Lock MT5+ cylinder dropped into an existing mortise lock. Both run about $200-$300 installed in NYC, including the rekey to match your existing keys if you want.

How common is bumping in NYC break-ins?

NYPD does not break out lock-bumping separately in its CompStat reports, but if you look at the burglary methods listed in the citywide year-end summaries, the dominant patterns are kicked doors (commercial back doors especially), pried windows, and "open door / no force." Lock-defeat attacks (picking, bumping, drilling) collectively land in the low single digits as a percentage of break-ins.

Why so low? Because for most criminals the math is wrong. A kicked door takes 3 seconds and works on almost every NYC apartment without a reinforced strike plate. Bumping requires a custom key, practice, and the patience to stand at someone's door making a tapping noise. The cost-benefit pushes most opportunistic break-ins toward force.

Where bumping shows up:

• Mailbox theft. Wafer-lock mailbox banks in lobbies are popped routinely with bump and rake techniques. See our mailbox lock replacement post once it goes live, and the mailbox lock replacement service page for the upgrade options.
• Targeted entries. A specific person with a specific reason to want into a specific door (domestic disputes, evictions handled outside the legal process, occasional industrial-espionage scenarios). These are not random; the attacker has time to learn the lock and acquire the right bump key.
• Inside jobs. A former roommate, ex-partner, or contractor who knows the building's lock brand. They may not even need a bump key if they retained an original.

If you are in one of those scenarios (recent breakup, fired an au pair, ground-floor apartment in a high-turnover building), bumping moves from theoretical to plausible. Upgrade.

The $80 upgrade that ends the conversation

For a standard NYC apartment with a single deadbolt, a Schlage B60 with a Schlage Everest C145 keyway upgraded to Primus pins runs about $180-$240 installed. The whole job, including rekeying to a fresh bitting and giving you new keys, fits in a 45-minute visit.

For a mortise-lock apartment door (which is most pre-war buildings), swapping the cylinder to a Mul-T-Lock Interactive+ or Medeco Maxum runs $250-$350 installed. The original lock body stays; only the cylinder changes. This means the door does not need to come off the hinges and no carpentry happens.

Either upgrade does three things at once:

1. Defeats bumping.
2. Defeats picking by all but the most practiced specialists.
3. Restricts key duplication, so the keys you hand out cannot be copied at the corner hardware store.

The third point is often more valuable than the first. The number of NYC break-ins linked to a copy of a key handed to a contractor, dog walker, or ex-tenant vastly exceeds the number linked to bumping.

What about smart locks?

Smart locks defeat bumping by not having a pin-tumbler cylinder at all (in the case of keyless models), or by having a deeply secondary backup cylinder that is less attackable than the average deadbolt. They introduce a different set of risks (battery failure, firmware bugs, the occasional headline-grabbing exploit), which we covered in the smart locks for NYC co-ops post and on the smart lock installation NYC page.

For an anti-bumping upgrade specifically, a good restricted-keyway mechanical deadbolt is still the right tool. Smart locks are a feature upgrade, not a security upgrade.

Frequently asked questions

Can I tell if my lock has been bumped? Sometimes. Bumping often leaves subtle marks on the keyway from the harder bump key abrading the brass. If you suspect a bumping attack, take the cylinder out and look at the entrance to the keyway under a strong light. A locksmith can usually tell. The more reliable signs are external: a key blank found nearby, your door slightly ajar when you left it locked, or pet behavior that suggests someone was in the apartment.

Are Kwikset SmartKey locks bumpable? The SmartKey mechanism uses a sidebar instead of traditional pin tumblers, so it is not bumpable in the classical sense. It has its own well-documented weaknesses (a $1 shim attack from a soda can, for example). Net security, lower than a basic Schlage Primus.

Will a Medeco lock be bumped? No, not realistically. Medeco's elevated pins rotate as well as lift, which means a bump key has nothing to bump against in the classic sense. There are documented attacks on certain Medeco generations under lab conditions, but they require specialized tools and minutes of access. Not a field-attack risk for a NYC apartment.

How much does upgrade cost in NYC, all-in? For a single-cylinder deadbolt swap to Schlage Primus or equivalent: $180-$240. For a mortise-lock cylinder upgrade to Mul-T-Lock or Medeco: $250-$350. Higher for full body replacement or commercial doors.

Does renters insurance cover lock upgrades? Generally no, because an upgrade is treated as an improvement to the unit, not a loss. Some policies will cover rekeying after a theft. Read your policy or call your agent. For the loss case (stolen keys, break-in), see our stolen keys 24-hour plan.

Are bump-resistant locks worth it if I am on a high floor? Even on a 6th floor, the upgrade is worth it because the bigger benefit is restricted key duplication, not bumping resistance per se. The number of unauthorized key copies floating around your building over a 10-year tenancy is usually higher than people think.