Six ways criminals can get around password protection

A stolen password is one way into an account, but it isn’t the only one. Criminals may hijack a login session, trick someone into approving a sign-in, take over a phone number or use malware to collect information from a device.

Passwords still matter. They’re just one part of account security, and changing one may not close every door. Here are six ways attackers can get around traditional password protection—and some steps that can help.

1. Stealing an active login session

When you sign in to a website or app, it may create a session that remembers you, so you don’t have to enter your password every time. Criminals can sometimes steal the digital tokens or cookies that keep that session active. If the service accepts them, an attacker may get in without your password or another verification step.

Review the devices and active sessions connected to your accounts. Sign out of anything you don’t recognize, and look for unusual login activity. If you suspect someone has accessed an account, change its password from a trusted device and revoke other sessions if the service lets you. Removing a device from an account list does not always end an active session, so check for a separate sign-out option.

2. Taking over your phone number

Your phone number may be linked to email, banking, payment and social media accounts. A criminal could persuade your mobile carrier to move your number to a SIM card or eSIM they control. If the transfer works, they may receive your calls and texts, including some account verification codes.

A sudden loss of cellular service without a known outage can be a warning sign. So can an unexpected carrier message about a device change or a password-reset request you didn’t make.

Ask your carrier about options such as an account PIN, number-transfer lock or port-out protection. The available safeguards differ by carrier. For important accounts, use a passkey, security key or authenticator app when possible. If text messages are your only second-step option, keep using them; they still offer more protection than a password by itself.

3. Wearing you down with sign-in requests

Multifactor authentication adds another layer of security, but criminals may try to target the person receiving the request. In an attack sometimes called MFA fatigue or push bombing, they send repeated sign-in prompts, hoping you’ll eventually approve one just to make them stop. They may also pose as technical support or a financial institution and ask you to read out a one-time code.

Don’t approve a login you didn’t start or share a code with someone who contacts you unexpectedly. If prompts keep appearing, deny them and check your account through its official app or website. Change your password if you think it may have been exposed. Passkeys and security keys can help resist phishing; approvals that require number matching may also reduce the chance of an accidental tap.

4. Using malware to collect information

Infostealer malware can gather information from a device, including browser-stored passwords, session cookies and payment details. It may arrive through fake software updates, pirated apps, suspicious attachments, malicious ads or compromised browser extensions. Sometimes it runs quietly, so there may not be an obvious sign that something is wrong.

Keep your operating system, browser and security software updated. Avoid downloading programs from unfamiliar sites, and check your browser extensions from time to time. If you think a device is infected, use a separate, trusted device to secure your important accounts. Run a security scan and remove suspicious software. A serious infection may call for professional help or an operating system reinstall. Wait to sign back in to sensitive accounts until you’re confident the device is safe.

5. Tricking you into approving an app

Some attacks don’t involve stealing a password or infecting your device. Instead, a criminal may get you to give a connected app permission to access your information. A convincing-looking tool might ask to read your email, view your contacts or manage files in cloud storage. If you approve a malicious app, it can use the access you granted—and that access may remain even after you change your password.

This approach is sometimes called OAuth consent phishing. In a September 2026 warning, the FBI said criminals could trick people into granting malicious apps access to their accounts, and that the access might continue until the app’s permissions are revoked.

Check the third-party apps connected to your important accounts, including Google and Microsoft accounts. Review what each one can access, and remove permissions for apps you don’t recognize or no longer use. Be especially cautious when an app asks for access to email, contacts, cloud files or account-management features.

6. Getting around passwords with other access routes

Passkeys can make traditional password phishing much harder. They rely on cryptographic credentials tied to a device, security key or password manager, rather than a password typed into a website. A properly implemented passkey is linked to the real service, making it much harder for a fake login page to steal it.

Still, passkeys don’t prevent every kind of account compromise. An attacker may target an already active session, an infected device, a connected app or the account recovery process. Use passkeys when important services offer them, protect your devices with a strong screen lock and keep your recovery details up to date. Store any backup recovery codes somewhere secure.

What to check after a password change

Changing a compromised password is important, but it may not sign out every device or remove every route into an account. Some services end existing sessions automatically; others require you to sign out of devices separately.

Also look for unfamiliar recovery addresses, connected devices, app permissions and email-forwarding rules. Someone with access to your inbox might quietly send copies of your messages elsewhere. Remove anything you didn’t authorize. If you reused the compromised password on other sites, change it there too and choose unique passwords. A password manager can help keep track of them.

If you suspect an account takeover, start with your primary email account, since it may control access to many others. Then review your mobile account and your financial accounts for unfamiliar activity.

A credit freeze is free and can make it harder for someone to open new credit accounts in your name. You need to contact Equifax, Experian and TransUnion separately to freeze your reports with each bureau. If you believe your identity has been stolen, the Federal Trade Commission’s IdentityTheft.gov offers a personalized recovery plan.

Identity theft can also happen outside the account you’re trying to protect. Exposed personal information may be used to apply for credit, take over a mobile account or attempt financial fraud. Monitoring services can alert you to some suspicious activity and, depending on the plan, may offer help with recovery. They can’t prevent every kind of identity theft, so they work best alongside careful account security.

Once a month, take a few minutes to review active sessions for your main email and financial accounts. Remove devices you no longer use, check recovery details and app permissions, and pay attention to unexpected login alerts or changes to your mobile account. It’s a small habit, but it can help catch problems before they grow.

Strong passwords and two-factor authentication are still worth using. But it’s easy to change a password and assume the problem is solved, even when a stolen session or connected app still has access. Check which devices and apps can reach your most important accounts, especially email and your mobile carrier account. A quick review now may save you a much harder cleanup later.