Identity thieves no longer need your password: six account-takeover threats and how to stop them

A stolen password is no longer the only way into your account. Cybersecurity experts say online criminals have learned that they do not always need the password itself: they can hijack an active login session, convince you to approve a sign-in, take control of your phone number, or use malware to collect information from your device. Passwords still matter, but they are only one part of the system protecting your identity. Experts now say passkeys, biometrics and face ID are the best way to protect our digital lives.

The first method is session hijacking. When you sign in to a website, the service creates a session so you do not have to enter your password every few minutes. Criminals can sometimes steal the digital tokens or cookies tied to those sessions, and if the service accepts the stolen information, an attacker may gain access without a password or another verification step. To protect yourself, review the devices and active sessions connected to your accounts, sign out of anything you do not recognize, and if you suspect unauthorized access, change your password from a trusted device and revoke other sessions where the service allows it. Removing a device from an account list does not always terminate an active login session.

The second method targets your phone number. A phone number is often connected to email, banking, payment and social media accounts. Criminals may try to convince a mobile carrier to transfer the number to a SIM card or eSIM they control; if the transfer succeeds, they may receive calls and text messages intended for you, including certain verification codes. A sudden loss of cellular service can be an early warning sign when there is no known local outage, as can an unexpected carrier notification about a device change or a password-reset message you did not request. Experts advise asking your carrier about an account security PIN, a number transfer lock and port-out protection, and using a passkey, security key or authenticator app for sensitive accounts, since app-based codes generally do not depend on your phone number.

The third method attacks multifactor authentication itself. MFA adds another layer of protection, but criminals sometimes target the person receiving the security request. In MFA fatigue, also called push bombing, an attacker who can trigger authentication requests sends approval notifications repeatedly, hoping you eventually tap "Approve" to make them stop. Criminals may also impersonate technical support or a financial institution and ask you to read aloud a one-time security code. Never approve a login you did not initiate or share a verification code with someone who contacts you unexpectedly. If repeated prompts appear, deny them and check the account through its official website or app, and choose phishing-resistant authentication such as a passkey or security key when available.

The fourth method is infostealer malware, software designed to collect information from a device. Depending on its capabilities, it may steal browser-stored passwords, session cookies, payment information or other sensitive data. These programs can arrive through fake software updates, pirated applications, suspicious email attachments, malicious advertisements or compromised browser extensions, and some operate quietly so you may not notice anything unusual. Keep your operating system, browser and security software updated, avoid downloading software from unfamiliar websites and review browser extensions regularly. If you suspect a device is compromised, use a separate, trusted device to secure important accounts and run a security scan before signing back in.

The fifth method is OAuth consent phishing. Some criminals do not need to steal your password or infect your device; instead, they trick you into giving a connected application permission to access your information. A fake productivity tool might ask to read your email, access your contacts or manage files in your cloud storage through a legitimate-looking permission screen. If you grant access, the malicious app may retrieve information through those permissions, and in certain cases the access can continue even after you change your password. In a September 2026 warning, the FBI explained that criminals can trick people into granting malicious applications access to their accounts, and that the access can remain active after a password change unless the victim revokes the application's permissions. Review the third-party applications connected to your Google, Microsoft and other important accounts, and remove permissions for apps you no longer use or do not recognize.

Passkeys can significantly reduce the risk of traditional password phishing. They use cryptographic credentials tied to your device, a security key or a password manager, and a properly implemented passkey is bound to the legitimate website, which makes it much harder for a fake login page to steal the credential. But passkeys do not eliminate every risk: criminals may still target an already authenticated session, an infected device, a malicious connected application or an account recovery process. Use passkeys when your important accounts support them, protect devices with a strong screen lock, keep recovery information current and store backup recovery codes securely.

Finally, changing a compromised password may not automatically remove every form of unauthorized access. Some services revoke existing sessions after a password change, while others require you to sign out of devices separately. A criminal might also have established another route in, such as an app-specific password, an unauthorized connected application or a new recovery method. Email deserves particular attention: someone with access to your inbox could create forwarding rules that quietly send copies of your messages elsewhere.