Lock change and rekey invoices: the old key is the test

A locksmith’s invoice arrives after a turnover: “rekeyed unit 214, 3 cylinders, 4 keys cut”, with a photo of the front door attached. The work may be exactly as billed. But rekeying changes the pins inside the cylinder. The face of the lock, the keyway and the finish stay the same. A photo of a freshly rekeyed deadbolt and a photo of one nobody touched are the same photo. This piece is about what the photos and the invoice can show, what they can’t, and a check that takes about a minute and doesn’t depend on any picture. It is not legal advice.

Why turnover rekeys are worth checking

They are frequent, small and invisible, which is the profile of a line item nobody looks at. They also matter: the point of a rekey is that the keys the last tenant had, and any copies they made, stop working. A rekey that was billed but not done is a security gap, not just an overcharge.

Some states make it a duty. Texas is an example we read: its Property Code (section 92.156) says a security device operated by a key, card or combination “shall be rekeyed by the landlord at the landlord’s expense” within seven days after each tenant turnover date. The same section lets a landlord deduct the cost from the deposit of a tenant who leaves in breach of a written lease, but only if the lease authorizes it in a provision “underlined or printed in boldface type”. So in Texas the ordinary turnover rekey is the landlord’s cost, and charging it to the departing tenant needs that specific lease term. Other states have their own rules, or none. Check yours before a rekey charge goes on a deposit statement.

What the photos can show

• That a lock is on the door. A photo shows the hardware, its brand if the face is visible, and roughly what kind it is.
• That hardware was replaced, sometimes. If the invoice says new locksets were installed rather than rekeyed, a different brand, finish or style from your move-in photos does show a change.
• Sometimes which unit and when. A door number in the frame ties the photo to a place. If the file still carries the camera’s own clock, the date should fall within the job.

What they can’t

• That a rekey happened. Nothing visible changes. This is the whole problem.
• That the old keys no longer work. That is the result you are paying for, and no picture records it.
• How many cylinders were done. A photo of the front deadbolt says nothing about the knob below it, the patio door or the storage closet.
• That the hardware is new. A clean lock photographed well looks new. Compare it with your own move-in photos before accepting “replaced” over “rekeyed”.

The check that needs no photo: the old key

At move-out, the tenant hands back keys. Keep one, tagged with the unit and the date. After the locksmith has been, put the old key in each lock on the invoice. If it turns, that lock was not rekeyed, whatever the photos show. If it doesn’t turn and the new key does, you have checked the actual result of the work yourself, in about a minute.

Be honest about what this can and can’t do. It works only if you kept a key that actually worked before, so try it on move-out day before the locksmith comes. It tells you the lock changed, not who changed it or what it cost. And it does nothing about copies of the new key, so keep track of how many were cut and who has them.

A minute of checks before you pay

1. Keep one returned key per unit, labelled, and try it in each lock after the work. It is the only check here that tests the result rather than a record of it.
2. Match the cylinder count. The invoice should list each cylinder by door: front deadbolt, entry knob, patio, storage. The count should match the doors the unit actually has.
3. Count the new keys. The invoice should say how many were cut, and that many should be in your hands or signed out.
4. “Rekeyed” and “replaced” are priced differently. If you were billed for new hardware, compare the lock in the photo with the one in your move-in photos.
5. Ask for the original photo files, not pictures pasted into an invoice PDF, which have usually lost their camera record. Why, and how to ask for the originals.
6. Drop this job’s photos in with the locksmith’s earlier ones. The checker marks any two files in the same batch that are the same file, even under different names. A door photo reused across units or across jobs shows up that way. A new photo of a lock that was never touched won’t, which is why the old key matters more than the photo.

Whether someone used AI on it

A picture of a deadbolt on a door is easy to generate now, and some generators write a mark into the file saying so. The checker reads those marks, and the notes some phone editors leave when generative AI was used to alter a photo. A file with no such mark is not proven real. Most fakes and most genuine photos look the same to a file reader once they have been through a chat app or a screenshot. But for a rekey, even a perfectly genuine photo proves nothing about the work. The old key is the check.

The limits, stated plainly

• A photo of a lock shows a lock. It doesn’t show that it was rekeyed, how many cylinders were done, or that the old keys stopped working.
• The old-key test shows the lock no longer takes that key. It doesn’t show who did the work, when, or what it should have cost, and it says nothing about copies of the new key.
• The Texas rule quoted here is Property Code section 92.156, read in October 2026 through a published copy of the code, not the legislature’s own site. It is one state’s rule. We have not covered Utah, Colorado or any other state’s rules on rekeying or on charging a tenant for it. Check your own state.
• A photo with no camera record is not a fake. Text messages, chat apps and many portals remove the record from genuine photos every day.
• Our checker gives no confidence score and does not judge a picture by looking at it. It reads what is in the file, in your browser, and uploads nothing. A file with no AI marker is not proven real.
• This is not legal advice.

Related: what a contractor’s “after” picture actually proves, and trash-out invoices and the dump receipt.

---

ImposterShield reads the evidence inside image and video files. It runs in your browser and uploads nothing. If a file has been stripped, it says so. If it has not read a file, it says that too.