Voice Purchasing on a Smart Speaker and How to Lock It Down

A package shows up that nobody in the house remembers ordering. It is a pack of AA batteries, or a fidget toy, or in one case a reader described to me, eleven rolls of the same paper towels. The order history says it came from the kitchen Echo at 4:12 p.m. on a Tuesday, which is exactly when the kids get home from school. Voice purchasing is switched on by default on most Amazon accounts, and the only thing standing between a speaker and your saved card is often nothing at all.

I spent six years installing alarm panels before I wrote about smart homes, and the rule there was simple: any action that costs money or opens a door needs a second factor. Smart speakers skipped that rule for convenience. Here is how to put it back without making the speaker useless for the shopping list.

Why voice orders slip through

A smart speaker does not know who is talking unless you have trained it to, and even then it guesses. Alexa's Voice ID and Google's Voice Match are recognition systems, not authentication systems. They are built to pick the right calendar, not to stop a determined eight year old who has heard you say "reorder dish soap" forty times.

There are three common paths to an unwanted order:

• Household members. Children account for most of the stories I hear. A child does not have to understand money to repeat a phrase that worked for a parent.
• Audio from other devices. In January 2017 a San Diego TV anchor said "Alexa ordered me a dollhouse" on air while reporting on a girl in Texas who had ordered a $160 dollhouse and four pounds of cookies. Viewers reported their own Echos trying to place orders. Amazon has since added filtering for broadcast audio, but a podcast or a YouTube video played near a speaker can still trigger a request.
• Guests. Anyone standing in your kitchen can talk to the speaker. Most people would never try, but a teenager's friend at a sleepover is a different risk profile from your aunt.

The speaker usually asks "Would you like to buy it?" before confirming. That prompt is the whole defence on a default setup, and a "yes" from anyone in earshot satisfies it.

Locking it down on Alexa and Google

Both platforms keep the controls a few menus deep. Set aside ten minutes and do this from the phone of the account owner, since household members usually cannot change payment settings.

1. Open the purchasing menu. In the Alexa app, tap More, then Settings, then Account Settings, then Voice Purchasing. In the Google Home app, open your profile picture, then Assistant settings, then Payments. Menu names shift with app updates, so if the path has moved, search the settings for "purchase".
2. Decide whether you want voice orders at all. If nobody in the house has bought something by voice in the last three months, turn purchasing off completely. You lose nothing. The shopping list still works, and you can add items by voice and buy them on your phone later.
3. If you keep it, set a voice code. Alexa lets you set a four digit code that has to be spoken to complete an order. Pick digits that are not your door code, your PIN or a birth year. Remember the code is spoken out loud, so anyone in the room hears it. Change it every few months, and change it straight away if you ever say it in front of a visitor.
4. Restrict purchases to recognised voices. Alexa has an option to allow purchases only from voices enrolled in Voice ID. Google ties payment approval to Voice Match. Turn this on in addition to the code, not instead of it. Recognition cuts down accidental triggers from the TV; the code covers people who sound close enough.
5. Handle the children separately. Put a child's speaker under Amazon Kids or a supervised Google profile. Both block purchases on that device regardless of the main account setting. A shared kitchen speaker is harder, which is why the code matters most there.
6. Turn on order notifications. Make sure the account owner gets a push notification and an email for every voice order. If something slips through, you want to know within minutes, not when the box lands on the porch.

While you are in the settings, check what else has payment access. Alexa skills that sell subscriptions or in-skill items can also charge your card, and they use the same confirmation settings in most cases. Google's digital purchases through Assistant follow the payment approval rules you set in step four.

The case against "just use recognised voices"

The most common advice I see online is to turn on Voice ID or Voice Match and leave it there, because the speaker "knows it is you". I disagree, and not only on paper.

Voice recognition is tuned to avoid annoying you. If it refused your request every time you had a cold, you would switch it off, so both companies lean toward letting borderline matches through. In my own testing over a weekend, with two adults and a fourteen year old in the same house, the speaker confused the teenager with his father on roughly one request in five. It was the same in reverse. Voices from one family often share pitch and accent, which is the exact case where recognition is weakest.

It also does nothing against recordings. A clip of your voice saying "yes" is still your voice.

Recognition is useful as a filter. It is a poor lock. Treat the voice code as the lock and recognition as the thing that keeps the TV from trying the lock in the first place.

What I run in my own house

Purchasing is off on every speaker except the kitchen one. That one allows reorders only, with a four digit code and Voice ID required, and every order sends a push to my phone and my partner's. The children's room speakers sit under kids profiles where buying is blocked at the device level.

In about two years with that setup we have had one attempted order we did not want, a set of headphones the teenager tried to buy by guessing the code. He got two digits right. The notification arrived before he left the kitchen.

If you also care about what the speaker keeps after a request, the guide to finding and deleting what your smart speaker recorded covers the history side, and the walkthrough on voice assistant profiles for every family member explains how to train recognition properly so the filter works as well as it can.

If an order already went through

Go to the order list in the Amazon app or website straight away. Orders placed by voice can often be cancelled before they ship, usually within the first hour or two, and the speaker itself will cancel the last order if you say "cancel my order" soon enough. If it has shipped, Amazon has generally treated voice-ordered physical items as eligible for free return, though I would check the specific order page rather than assume. Digital content and skill purchases are harder to reverse and may need a support chat.

Then fix the setting that let it happen, before the next afternoon at 4:12. More voice assistant setups are collected in the voice assistants section.

Frequently asked questions

Is voice purchasing on by default on Alexa?

On most Amazon accounts with a saved payment method and 1-Click enabled, yes. Check Settings, Account Settings, Voice Purchasing in the Alexa app to see your current state.

Can someone hear my Alexa voice code?

Yes. You say it out loud, so anyone in the room can learn it. Change it after guests visit and never reuse a code from your bank or alarm.

Can a TV ad make my smart speaker buy something?

It can trigger a request, and both companies filter known broadcast audio, but not every clip. A voice code stops the request from completing even when the wake word gets through.

Does turning off voice purchasing break the shopping list?

No. You can still add items by voice and review or buy them later in the app.