You may think of a stolen password as the main way someone gets into your account.
uncertain
someone → think → account
But online criminals have learned that they do not always need to steal the password itself.
asserted
they → learn → password
They may hijack an active login session, convince you to approve a sign-in, take control of your phone number or use malware to collect information from your device.
uncertain
They → hijack → device
However, they are only one part of the security system protecting your identity.
asserted
they → protect → identity
Here are six ways criminals may try to get around traditional password protection and the practical steps you can take to protect yourself.
uncertain
you → try → yourself
Join our CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season.
asserted
Knutsson → join → trip
You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful.
asserted
travels → learn → technology
No technical experience is needed.
asserted
experience → need → ?
When you sign in to a website, the service often creates a session that tells it you have already proved who you are.
asserted
you → sign → it
Your browser or app may keep that session active so you do not have to enter your password every few minutes.
uncertain
you → keep → password
Criminals can sometimes steal the digital tokens or cookies associated with these sessions.
asserted
Criminals → steal → sessions
If the service accepts the stolen information, an attacker may gain access without entering your password or completing another verification step.
uncertain
attacker → accept → step
Sign out of anything you don't recognize and check for suspicious login activity.
asserted
you → sign → activity
We've previously explained how to check for unfamiliar devices and remove them from your Apple, Google and Microsoft accounts.
asserted
We → explain → accounts
If you suspect unauthorized access, change your password using a trusted device and revoke other sessions when the service allows it.
asserted
service → suspect → it
Remember that removing a device from an account list does not always terminate an active login session.
asserted
removing → remember → session
Your phone number is often connected to email, banking, payment and social media accounts.
asserted
number → connect → email
Criminals may try to convince a mobile carrier to transfer your number to a SIM card or eSIM they control.
uncertain
they → try → card
If the transfer succeeds, they may receive calls and text messages intended for you, including certain account verification codes.
uncertain
they → succeed → codes
A sudden loss of cellular service can be an early warning sign, especially when there is no known local outage.
asserted
loss → be → service
Other signs include an unexpected carrier notification about a device change or a password-reset message you did not request.
asserted
you → include → change
These protections vary by carrier.
asserted
protections → vary → carrier
Unlike text verification codes, authenticator app codes generally do not depend on your phone number.
asserted
codes → depend → number
If text messages are your only available second authentication method, keep them enabled.
asserted
them → keep → ?
They still provide more protection than relying on a password alone.
asserted
They → provide → password
Multifactor authentication, or MFA, adds another layer of protection to your accounts.
asserted
authentication → add → accounts
However, criminals sometimes target the person receiving the security request.
asserted
criminals → target → request
One tactic is MFA fatigue, also called push bombing.
asserted
tactic → call → ?
An attacker who can trigger authentication requests repeatedly sends approval notifications, hoping you eventually tap "Approve" to make them stop.
asserted
them → trigger → notifications
Criminals may also impersonate technical support or a financial institution and ask you to read aloud a one-time security code.
uncertain
Criminals → impersonate → code
How to protect yourself: Never approve a login you did not initiate or share a verification code with someone who unexpectedly contacts you.
asserted
who → protect → you
If repeated prompts appear, deny them and check the account through its official website or app.
asserted
prompts → repeat → website
Change your password if you suspect it has been compromised.
asserted
it → change → password
App-based approvals that require number matching can also offer additional protection against accidental approvals.
asserted
that → base → approvals
4. Malware and risky browser extensions
An infostealer is malicious software designed to collect information from a device.
asserted
infostealer → design → device
Depending on its capabilities, it may steal browser-stored passwords, session cookies, payment information or other sensitive data.
uncertain
it → depend → passwords
These programs can arrive through fake software updates, pirated applications, suspicious email attachments, malicious advertisements or compromised browser extensions.
asserted
programs → arrive → updates
Some malware operates quietly, which means you may not immediately notice anything unusual.
uncertain
you → operate → anything
How to protect yourself: Keep your operating system, browser and security software updated.
asserted
system → protect → yourself
If you suspect malware has compromised a device, use a separate, trusted device to secure important accounts.
asserted
malware → suspect → accounts
…and 60 more, not listed.
The Aporia
