Lock Picking vs. Lock Bumping: How Thieves Get In and How to Stop Them

Lock picking and lock bumping are the two most common non-destructive methods used to bypass pin tumbler locks -- the type installed on the vast majority of NYC apartment doors, brownstone entries, and commercial storefronts. Lock picking uses individual tools to manipulate each pin one at a time and requires practice and patience. Lock bumping uses a specially cut "bump key" struck with a mallet to force all pins to jump simultaneously, and it can be learned in minutes from online tutorials. Both leave little to no visible damage, which means you may not even realize your lock was defeated. Below is a detailed breakdown of how each method works, which locks are vulnerable, and what you can do right now to protect yourself.

How Lock Picking Works

Lock picking is the older of the two techniques and the one most people picture when they think of bypass methods. A picker inserts two tools into the keyway: a tension wrench (a thin L-shaped piece of metal that applies slight rotational pressure to the plug) and a pick (a thin tool with a shaped tip used to manipulate the individual pin stacks).

Inside a standard pin tumbler lock, there are typically five or six spring-loaded pin stacks. Each stack consists of a key pin (bottom) and a driver pin (top). When no key is inserted, the driver pins straddle the shear line -- the boundary between the rotating plug and the stationary housing -- preventing the plug from turning. The correct key pushes each pin stack to exactly the right height so that the gap between key pin and driver pin aligns with the shear line across all stacks simultaneously.

A picker exploits manufacturing tolerances. No lock is machined perfectly, so one pin will bind against the plug before the others when rotational pressure is applied. The picker applies slight tension, then uses the pick to push the binding pin to the shear line. Once that pin sets, the next loosest pin begins to bind, and the process repeats until all pins are set and the plug turns freely.

Common picking techniques

• Single pin picking (SPP) -- the methodical approach described above, manipulating one pin at a time. Requires the most skill but gives the most control and feedback.
• Raking -- a faster but less precise method where a serrated pick is rapidly moved in and out of the keyway while tension is applied, hoping to set multiple pins at once through random motion.
• Rocking -- similar to raking but with a rocking motion that mimics a wave pattern across the pins.
• Electric pick guns -- battery-powered devices that vibrate a needle pick at high speed, bouncing pins to the shear line. Used by locksmiths and sometimes by criminals.

How Lock Bumping Works

Lock bumping was documented by Danish locksmiths in the 1970s but became widely known after a 2005 Dutch television segment demonstrated how easy it was. A bump key is a blank key cut to the deepest possible position on every pin (typically the "9" depth in most keyway systems). The attacker inserts the bump key one pin short of fully seated, applies light rotational pressure, then strikes the bow of the key sharply with a small mallet or screwdriver handle.

The impact energy transfers through the key pins to the driver pins, causing them to jump momentarily above the shear line -- exactly the way a Newton's cradle transfers energy through a line of balls. During the fraction of a second that all driver pins are above the shear line, the applied tension rotates the plug and the lock opens.

Why bumping is more dangerous than picking for NYC residents

• Skill floor is almost zero. Picking takes weeks or months of practice. Bumping can be learned from a five-minute video and performed successfully on the first attempt.
• Speed. A practiced bumper can open a standard pin tumbler lock in under 10 seconds. Picking the same lock might take 30 seconds to several minutes.
• Bump keys are easy to obtain. Sets of bump keys for common keyways (Kwikset, Schlage, Yale, Sargent) are sold online for under $30.
• Most NYC apartment locks are vulnerable. The standard Schlage or Kwikset deadbolts installed by landlords and property managers across the five boroughs have no anti-bump features. Pre-war buildings with older mortise locks are also generally bumpable unless the cylinder has been upgraded.

Lock Picking vs. Bumping: Side-by-Side Comparison

Which NYC Locks Are Most Vulnerable?

The short answer: any standard pin tumbler lock without specific anti-pick and anti-bump features. Here is what that means in practice across New York City neighborhoods:

• Post-war apartment buildings (1950s-1980s): Typically have Schlage or Yale knob locks and deadbolts with standard 5-pin cylinders. These are vulnerable to both picking and bumping. Common across Queens, the Bronx, and outer Brooklyn.
• Pre-war buildings (brownstones, walk-ups): Often have original or replacement mortise locks. The mortise body itself is robust, but the cylinder is usually a standard pin tumbler that can be picked or bumped unless upgraded. Common in Park Slope, Upper West Side, and Brooklyn Heights.
• Modern condos and co-ops: Newer buildings often have electronic fob entry for the building but standard deadbolts on individual units. The unit-level lock is the weak link.
• Commercial storefronts: Many use standard cylinders in aluminum-frame doors. Without a high-security cylinder upgrade, these are among the easiest to bump.

How to Protect Against Lock Picking and Bumping

The most effective protection is upgrading to a high-security lock that is specifically engineered to resist both attack methods. Here are your best options in order of effectiveness:

1. High-security cylinders with anti-bump pins

Locks from Mul-T-Lock, Medeco, and ASSA Abloy use patented internal mechanisms that defeat both picking and bumping. Mul-T-Lock's Interactive+ series uses telescoping pin-in-pin design -- a bump key cannot transfer energy correctly through the nested pins. Medeco uses pins that must both lift and rotate to the correct angle, adding a dimension that bump keys cannot address. These are the gold standard for NYC apartment security.

2. Restricted keyway systems

Restricted keyway locks use key profiles that cannot be duplicated at ordinary hardware stores or purchased as blank bump keys online. This eliminates the bump key supply chain entirely. Many NYC co-op boards and property managers now specify restricted keyways for exactly this reason.

3. Secondary security measures

• Door reinforcement plates: Even if a lock is bypassed, a reinforced strike plate with 3-inch screws into the door frame makes forced entry much harder.
• Security cameras and video doorbells: Visible cameras deter most opportunistic criminals. They cannot pick or bump a lock if they know they are being recorded.
• Door chains and auxiliary locks: A secondary lock (chain, swing bar, or surface-mounted deadbolt) provides a second barrier even if the primary lock is defeated.
• Sliding door security: If your apartment has a sliding glass door or patio door, secure it with a track bar or secondary lock -- these are often the easier entry point.

4. Smart locks (with caveats)

Smart locks that have no physical keyway eliminate the picking and bumping attack surface entirely. However, many smart locks include a physical key backup cylinder for emergency access, and that cylinder may be a standard pin tumbler. If your smart lock has a key backup, confirm that it uses a high-security cylinder. Smart locks also introduce different vulnerabilities: Bluetooth interception, firmware exploits, and dead batteries can all create their own lockout scenarios.

What to Do If You Suspect Your Lock Was Picked or Bumped

1. Do not enter your home or office. If you notice signs that someone may have entered -- a door that was locked but is now unlocked, belongings moved, or marks around the lock -- call 911 first.
2. Document everything. Photograph the lock face, keyway, and any marks before anything is touched. This evidence matters for both police reports and insurance claims.
3. Call a locksmith for a security assessment. A licensed locksmith can examine the lock internals for evidence of picking or bumping and recommend an appropriate lock upgrade.
4. File a police report. Even if nothing appears stolen, a report creates a record that supports insurance claims and helps NYPD track patterns of break-in methods in your neighborhood.
5. Upgrade your locks immediately. If your lock was defeated once, the same key or technique will work again. Replace the cylinder (at minimum) or the entire lock with a high-security option.

NYC Building Code and Lock Security Requirements

New York City's Housing Maintenance Code (Section 27-2043) requires landlords to provide self-closing, self-locking doors with at least one deadbolt lock on every apartment entrance. However, the code does not specify anti-pick or anti-bump requirements. This means that a landlord can legally install the cheapest compliant deadbolt, which is almost certainly vulnerable to both picking and bumping.

As a tenant, you have the right to install additional locks at your own expense (NYC Housing Code 27-2043.1) as long as you provide the landlord with a key. This means you can add a high-security deadbolt or auxiliary lock without your landlord's permission. When you move out, the lock stays and you hand over the keys. Read our guide on who pays for a locksmith (tenant vs. landlord) for more details on your rights.

A Note on Legality

In New York State, possession of lock picking tools is legal. However, possessing them with the intent to commit a crime is a Class A misdemeanor under NY Penal Law Section 140.35 (Possession of Burglar's Tools). Bump keys fall into the same legal gray area: they are not illegal to own, but using them to enter someone else's property without permission is burglary. The accessibility of these tools is precisely why upgrading your locks matters -- the law alone does not keep them out of the wrong hands.

Frequently Asked Questions