Realtors · problem and fix
How to change lockbox codes after each showing: a realtor's guide for 2026
Change lockbox codes after each showing when you can. A shared code reaches more people than you planned, and it often stays the same for weeks. This guide covers what that costs, why codes leak, and fixes you can start today without buying anything.
The short answer
- Change the code after each showing when your lockbox system allows it.
- Shared codes carry real cost. Ontario fines for lockbox violations start at $5,500.
- Codes leak because too many people hold them and few people change them.
- Access logs and appointment-based access are the strongest fixes, but most evidence comes from vendors and associations.
- I found no Mac app listed for SentriKey or Supra eKEY in the App Store pages I opened. Plan on a web version or your iPhone.
What lockbox code security costs you
Regulator fines and discipline
In Ontario, RECO fines for lockbox violations start at $5,500 and reach $9,500 for repeat or contested violations. Nearly all substantiated complaints led to disciplinary action. For a working agent, a discipline record can matter more than the fine itself.
Client trust
A homeowner who finds a family inside the home will remember the agent's name. The Milwaukee-area case began with exactly that discovery. Police said no crime appeared to have been committed, but the trust damage was done.
Insurance exposure
CRES Insurance says the main risk to seller's agents is unauthorized use of the code to access the property. A shared code makes it harder to show who had access after a problem.
Your time after a leak
I found no study that measures the hours lost after a lockbox problem. Expect calls, written reports, and meetings with your broker. Plan for that cost even though nobody has measured it yet.
Seller relationships
A seller trusts you with access to an empty home. One unauthorized visit can strain that trust and make the next listing conversation harder. Protect the code as part of that promise.
Why it happens
Too many people hold the code
A single code often reaches the listing agent, the buyers' agent, other brokerages, stagers, photographers, and trades. Each person passes it on. Few people track that chain, so nobody knows the full list of who has it.
Codes rarely change
Changing a code takes effort, so many agents skip it. CRES Insurance recommends a change after each showing when possible, and at least weekly when contractors are accessing the box. CRES cites no source for the weekly rule, so treat it as advice.
Combination codes leave no record
A plain combination box cannot tell you who opened it. If a code leaks, you cannot check the history. Electronic systems with logs solve part of this problem, depending on the vendor and the plan you buy.
Codes live in texts, email, and sticky notes
Codes travel through the tools you use every day. A code in a Gmail thread can stay there for years. A code in a shared spreadsheet is visible to everyone with the link. Each copy is another place to leak from.
Cost and brokerage pressure
One Realtor told WISN that three large brokerages blocked the move to electronic lockboxes, citing cost. That is one agent's claim, reported by the outlet, and not an independent finding. It still shows that cost shapes which systems get used.
No written rule for contractors
Without a written rule, each agent decides for themselves who gets the code and for how long. The Ontario report says codes must never be shared. A rule on paper is what turns that principle into daily practice.
How to fix it
These work with or without any app.
Change the code after each showing
This is the fix behind the target phrase. Change the code after each showing when your lockbox system allows it. CRES Insurance recommends this habit. It works best when you also send the next person the new code in a direct message.
Give each visitor a time window
Tell every visitor when they can enter. Ask the roofer, cleaner, or stager to message you when they finish. A visit with a start and an end gives you a clear point to change the code.
Keep a change log without the code
Log the date, who got access, why, and when they finished. Never write the code itself in the log. Keep the sheet shared only with people who need it, and check its version history from time to time.
Clean out old lockbox threads
Search Gmail for the word lockbox. Open each thread with a live code, then delete the code line or the thread. Old threads are easy to forget, and they keep working as a leak long after the listing closes.
Ask about call-before-showing codes
NAR describes call-before-showing codes as a second code entered after the normal lockbox code. The listing agent can change it if too many parties without an offer hold it. Ask your board or brokerage whether your lockbox system supports one.
Use appointment access where it exists
NAR describes SentriLock's Access By Appointment. The appointment sets when the box opens, and a cancelled appointment blocks access. These are vendor and association descriptions, so test the system with a low-stakes listing before you rely on it.
Put one contractor rule in writing
Write one rule that covers who may hold the code, when they may use it, and what happens when they leave. The Ontario report says only licensed agents should access the lockbox unless the seller explicitly allows otherwise. Send the rule to your broker and the seller.
Why lockbox code security matters for realtors
A lockbox code works like a key that anyone can pass on. Once it leaves your phone or your memory, you lose control of it. That is the whole problem in one sentence. Regulators, police, and insurers all describe the same pattern. A code goes to more people than you meant, and it stays the same for too long.
The clearest numbers come from Ontario. RECO, the province's real estate regulator, gets a steady stream of complaints about agents who gave unauthorized people access to listed homes. Its registrar says that level is 20 to 40 complaints a year. It has held for about five years.
Those complaints are a regulator's workload, not a fringe problem. Fines start at $5,500. Repeat or contested cases reach $9,500. The same report says nearly every substantiated complaint led to disciplinary action.
Ontario is not the only place this shows up. In a Milwaukee-area case reported on January 4, 2017, a homeowner came home to find a family inside. They told police their Realtor had given them the lockbox combination. Police said no crime appeared to have been committed. The case still shows the core problem. The code moved from the agent to people the homeowner never approved.
20 to 40
complaints a year about agents giving unauthorized lockbox access, per RECO's registrar
Unauthorized lockbox use triggers action and reform (Real Estate Magazine)$5,500
starting RECO fine for a lockbox violation, rising to $9,500 for repeat or contested cases
Unauthorized lockbox use triggers action and reform (Real Estate Magazine)60%
of Greater Milwaukee Association of Realtors members wanted to keep traditional lockboxes, in a 2017 report
Key tool Realtors use could be hidden danger to homeowners (WISN)427,000
sales agents employed in the United States in 2025, per the Bureau of Labor Statistics
Real Estate Brokers and Sales Agents (BLS Occupational Outlook Handbook)What shared lockbox codes cost you
The fine is the easiest cost to see. A discipline record can matter for years, long after the fine is paid. Treat a lockbox breach as a licensing issue first and a service issue second.
- Discipline: a fine, an investigation, and possibly a note on your licensing record.
- Client trust: a homeowner who finds strangers inside will not forget who gave them the code.
- Insurance: CRES Insurance calls unauthorized use of the code the main risk to seller's agents.
- Property: a stranger in a listed home can take, break, or photograph things you did not expect.
- Your time: a breach brings calls, reports, and meetings. I found no study that measures those hours.
Be honest about the evidence. The numbers here come from complaint counts, one 2017 report, and insurer and association pages. I found no primary study on lost time, grades, or burnout tied to lockboxes. The chief executive of the Calgary Real Estate Board said that board had no reports or issues of lockbox abuse. The risk looks real in some places and unmeasured in others.
Why lockbox codes leak in the first place
Three habits explain most leaks. Codes go to too many people. Codes rarely change. Combination boxes give you no record of who entered. Each habit is easy to fix on its own. Together they turn one lockbox into an open invitation for anyone on the chain.
Follow one code through a normal listing. The listing agent gets it, then the buyers' agent. Other brokerages ask for access. Stagers, photographers, and trades want a way in. Each person passes the code to someone they trust. Few people write that chain down, so nobody can list everyone who has it.
| Lockbox type | Typical price | What you can see |
|---|---|---|
| Traditional combination box | About $30 | Nothing about who entered. A leaked code stays valid until someone changes it. |
| Electronic lockbox | Up to $100 | Depends on the system. Some vendors offer access logs. |
| Appointment-based system | Varies by vendor | Access ends when the appointment is cancelled, per NAR's description of SentriLock. |
The Mequon police chief put the risk in one line: 'Your safety and the items in your house are only as safe as how many people know the combination to the lockbox.' The chief said an electronic code would be more secure. That number of people is the variable you control.
Fixes you can start without buying anything
You do not need a new system to start. Most of these steps use Gmail, Google Sheets, and a habit. Start with the change log and the contractor rule. They take one conversation with your broker, and they cost nothing.
Keep a lockbox change log without the code
A change log tells you who had access and when. It does not need the code itself. Open Google Sheets for realtors on Mac and make one row for each visit. Use these columns: date, person, role, reason, and finish time. Leave the code out of the sheet.
Shared spreadsheets are visible to anyone with the link. In Google Sheets, go to File > Version history > See version history to see who changed what. Limit the sharing to people who actually need the log.
A worked example for one busy listing day
Say a roofer needs the house on Tuesday morning. The buyers' agent tours it in the afternoon. Before the roofer arrives, you send a note with the time window. You ask them to text you when they finish. Once they text, you change the code and log the visit.
The afternoon tour needs the new code. Send it to the buyers' agent in a direct message, not a group thread that includes the roofer. Then confirm the box opens before you leave. If it fails, you want to know while you are still on site.
How often should you change lockbox codes?
The honest answer is after each showing, when your lockbox system allows it. CRES Insurance says the same thing. It also says at least weekly when contractors have access. CRES cites no data for either rule, so treat them as strong advice, not proof.
Some systems make a change quick. Others need a call to the vendor or the listing agent. If a change takes a call, set a risk rule instead. Change the code after any contractor visit. Change it when someone leaves your team. Change it before a stretch of busy showings.
Mistakes people make with lockbox codes
- Changing the code, then forgetting to tell the one agent who needed it.
- Texting the code to a group thread that includes contractors.
- Keeping the code in a notes app that syncs to a shared laptop or family device.
- Writing the code on a sticky note in a car, an office, or a lobby.
- Trusting a vendor app without asking for its security documentation.
- Assuming a verbal okay from a seller covers every visitor.
Old email is the hidden leak. Codes sit in threads for years. In Gmail, click the search box at the top of the window and type lockbox. Open each thread that has a live code. Delete the code line or the whole thread, then note the cleanup in your log. Gmail for realtors on Mac covers a setup that keeps client mail in one place.
Lockbox access logs and appointment-based access
Electronic systems move the control from paper to phones. SentriLock is the clearest example in my research. According to SentriLock, the SentriKey app talks to SentriGuard hardware over Bluetooth. It can generate offline codes. With the Showing Service, you can review past access from the schedule view.
NAR describes Access By Appointment with SentriLock. The appointment sets when the box opens. If the appointment is cancelled, access is blocked. NAR also says listing agents do not need to share call-before-showing codes in that model. These are descriptions from NAR and SentriLock, not an independent test.
Call-before-showing codes sit on top of the normal code. NAR describes a second code that you enter after the lockbox code. The listing agent can change that second code if too many parties without an offer hold it. Ask whether your board or lockbox system supports this setup.
The Ontario article also describes TRREB's planned system. It gives each Realtor individual credentials, real-time tracking of visits, and access limited to scheduled appointments. The article gives no start date beyond 'this fall'. Watch for the rollout before you assume it covers your listings.
Where Lazur helps, and where it does not
Lazur does not change your lockbox code. It does not click buttons or run your lockbox app for you. It helps with the work around the code. Hold ⌥ ⌘ to ask about anything on screen, and Lazur answers out loud. Ask where a setting is, and Lazur draws a circle and a label around it.
Hold fn to dictate clean text at the cursor in any app. That helps with a change log line or a note to a contractor. You still check the text before you save or send it. Lazur can also run research in its own Chrome tabs and return a summary and a report. Verify anything it finds against your board's own page.
Privacy matters here. Lazur listens and looks at your screen only while you hold the shortcut. Audio and the screenshot go to AI providers to answer, and they are not stored. Content is never used to train AI models. Still, do not hold the shortcut while a live code is on screen unless you are comfortable with that.
Using lockbox apps on a Mac
Most guides skip this part. I checked the App Store listings for two common lockbox apps. The SentriKey Real Estate listing shows iPad, iPhone, and Apple Watch. It has no Designed for Mac label. SentriLock's own page says you can use the app from your phone or computer, and it mentions a web version.
The Supra eKEY listing I opened lists iPhone, Apple Watch, and Apple Vision. It does not list iPad or Mac. A Mac user with either app will likely need a web version, if the provider has one, or an iPhone app. I did not test either route on a Mac.
App Store pages change by country and over time. Check the listing for your region before you install anything. If the web version is your route, open it in Chrome and press ⌘ F to find a log entry on the page.
Rules to follow, whatever your board says
Realtors work under licensing rules, brokerage policies, and local board rules. Those set who may hold a code and when access is allowed. Follow your brokerage and your board first. If your state or province has a regulator, follow its rules too. This page is a practice guide, not legal advice.
The Ontario report sets a clear baseline. Codes must never be shared. Only licensed agents should access the lockbox unless the seller explicitly allows otherwise. Use that as a starting point, then ask your broker where your local rule differs.
Questions to take to your broker this week
- Who holds the current code for each listing, and how did each person get it?
- Does our lockbox system log each entry, and who can see the log?
- Can we use call-before-showing codes on our listings?
- What does our brokerage expect after a contractor visit?
- Where should the change log live, and who may open it?
Next steps
Start with the change log and the contractor rule. Those steps need no new app and no budget. Then ask your broker about access logs and appointment access. If you want voice help with the work around the code, download Lazur or compare plans on the pricing page.
Faster with Lazur
Where Lazur helps with lockbox code security
Hold ⌥ ⌘ and say what you want. Lazur sees your Gmail window. Lazur reads what's on screen and writes the draft at your cursor for you to check.
- 1
Hold ⌥⌘ and talk
- 2
Lazur reads what's on screen and writes the draft at your cursor for you to check.
- 3
You stay in Gmail. Nothing to copy into a chat window.
More things to say in Gmail
- “Walk me through where the lockbox settings are in this web app”
- “Hold fn and dictate your change log line”
- “Draft a note to the roofer for Tuesday morning”
- “Explain what a call before showing code is”
- “Research what our board requires for lockbox access”
- “Where is the access log on this screen?”
Free for 3 days, then $18/month. Download for Mac
You say“Draft a note to the roofer for Tuesday morning, and ask them to text me when they finish.”
Lazur · drafts itLazur types a short note into your open Gmail draft. It names the time window and asks for a text when the roofer finishes. You read it, then send it yourself.
Draft at your cursor
A short draft that names the window, asks for a text when the roofer is done, and leaves the lockbox code out.
What realtors say to Lazur for this
Each one is a single hold of ⌥ ⌘.
“Walk me through where the lockbox settings are in this web app”
Lazur draws a circle and a label around the setting you ask about. You click it yourself, and Lazur waits for each click.
Walks you through it
“Hold fn and dictate your change log line”
Lazur types clean text at the cursor in your open sheet or email. You read it before you save or send.
Types what you say
“Draft a note to the roofer for Tuesday morning”
Lazur types a draft into your open email with the time window and a request to text when finished. You send it yourself.
Drafts it
“Explain what a call before showing code is”
Lazur answers out loud. Use the answer to prepare for a broker call, then check it against your board's own rules.
Explains what's on screen
“Research what our board requires for lockbox access”
Lazur runs the research in its own Chrome tabs and returns a summary and a report. Check the sources it cites before you rely on them.
Researches in the background
“Where is the access log on this screen?”
Lazur points at the element with a circle and label. Useful when a web app moves its menus after an update.
Points at it
A plan you can start this week
- Day 1
Set the rule and the log
Write one rule for contractors and agents. Cover who may hold the code, when they may use it, and what happens after. Create a Google Sheets log with date, person, reason, and finish time. Keep codes out of the sheet.
- Day 2
Clean old threads
Search Gmail for lockbox. Open each thread with a live code, delete the code line or the thread, and note the cleanup in your log. Start with listings you are still showing.
- Each showing
Change, then tell
After each showing, change the code when the system allows it. Send the new code to the next agent in a direct message, not a group thread. Confirm the box opens before you leave.
- Each visit
Track contractors
Before a roofer, cleaner, or stager arrives, send the time window and the message-me rule. When they finish, log the visit and change the code if your rule says so.
- Next week
Ask your broker
Ask whether your lockbox system logs each entry and supports call-before-showing codes. Ask who can see the log. Write the answers in your sheet so the rule has a source.
- First month
Review the log
Read the log for patterns. Check which listings had the most visits and which people had access. Adjust the rule wherever the log shows a gap.
Questions people ask
How often should you change a lockbox code?
After each showing, when your lockbox system allows it. CRES Insurance says to change it after each showing when possible, and at least weekly when contractors have access. CRES cites no data for these rules, so use them as a starting point and match them to your listing risk.
Is it okay to share a lockbox code with a contractor?
It depends on your brokerage, your board, and your regulator. The Ontario report says codes must never be shared, and only licensed agents should access the lockbox unless the seller explicitly allows otherwise. Ask the seller and your broker in writing before you share any code.
What is a call before showing code?
NAR describes it as a second code that you enter after the normal lockbox code. The listing agent can change that second code if too many parties without an offer hold it. Ask your board or lockbox provider whether your system supports it.
Can you see who used a combination lockbox?
Usually not. A plain combination code gives you no record of who entered. That is why many people look for access logs or appointment-based systems. Check which type of box your listing uses.
Does Lazur change lockbox codes for me?
No. Lazur does not click buttons or operate your lockbox app. It can draw a circle around a setting, walk you through steps one click at a time, dictate or draft text, and answer questions out loud.
Can I use the SentriKey app on a Mac?
The App Store listing I opened shows iPad, iPhone, and Apple Watch, with no Designed for Mac label. SentriLock's page mentions a web version. Check the listing for your country, and ask SentriLock what your account supports.
What belongs in a lockbox change log?
Record the date, the person who got access, their role, the reason, and when they finished. Never write the code itself in the log. Limit who can open the sheet.
Are fines the only risk from a lockbox leak?
No. Fines are visible, but client trust and your reputation are harder to measure. In the Milwaukee-area case, police said no crime appeared to have been committed, yet the homeowner still found strangers inside.
Sources
- Unauthorized lockbox use triggers action and reform by real estate authorities · Real Estate Magazine · checked 2026-11-07
- Key tool Realtors use could be hidden danger to homeowners · WISN · checked 2026-11-07
- Real Estate Lockbox Risks and How to Manage Them · CRES Insurance · checked 2026-11-07
- Call Before Showing Codes Enhance Customer Service · National Association of REALTORS · checked 2026-11-07
- SentriKey Real Estate App · SentriLock · checked 2026-11-07
- SentriKey Real Estate (App Store) · Apple App Store · checked 2026-11-07
- Supra eKEY (App Store) · Apple App Store · checked 2026-11-07
- Real Estate Brokers and Sales Agents (Occupational Outlook Handbook) · U.S. Bureau of Labor Statistics · checked 2026-11-07
Fix lockbox code security with Lazur, free for 3 days
Hold a key and ask. Lazur sees your screen, points at the button and talks you through it, in any Mac app. No credit card.