Your Password Just Leaked. Here's Why the Criminal Still Can't Get In
Picture this: a stranger types your email into your bank's login page, then types your password — and it's correct. Maybe it leaked in a data breach. Maybe you reused it on a site that got hacked. Maybe they guessed it from your social media.
With two-factor authentication (2FA) switched on, that correct password gets them nowhere. The login stops and asks for a second proof it's really you — one the stranger doesn't have. The US Cybersecurity and Infrastructure Security Agency (CISA) explains it simply: even if a criminal compromises one factor, like your password, they can't meet the second requirement, so the break-in fails.
Three Kinds of Proof
As Canada's Cyber Centre explains, every login check is built from three types of factors:
- Something you know — a password or PIN.
- Something you have — your phone, an authenticator app, or a physical security key.
- Something you are — a fingerprint or face scan.
Two-factor authentication means combining two different types. You already do it at a bank machine: your card (something you have) plus your PIN (something you know). 2FA is one form of multi-factor authentication, or MFA — the same idea, sometimes with more layers.
Why a Password Alone Fails
Passwords get reused, guessed, cracked, and stolen. CISA warns that even a complex password can be defeated — and that a password can sometimes be guessed from what you post online. The numbers show why the second lock matters: Canada's Cyber Centre, citing a 2019 Microsoft study, says MFA can block 99.9% of account compromises. One extra step, and nearly every stolen-password attack hits a wall.
Not All Second Steps Are Equal
CISA ranks authentication methods from strongest to weakest — and the order surprises people.
Weakest: text-message (SMS) codes. Convenient, but the codes travel unencrypted, and Canada's Cyber Centre says SMS should only be considered for low-risk logins. Criminals can intercept the codes through SIM swapping — convincing your phone carrier to transfer your number to a SIM card they control, so your codes arrive on their phone. CISA calls SMS a last-resort option only.
Stronger: authenticator apps. An app on your phone generates a fresh six-digit, one-time code for each sign-in. The code never travels over the phone network, so SIM swap and text interception don't apply. It can still be phished if you type it into a fake login page, so glance at the address bar first.
Stronger still: push approvals — with a warning. The app pops up an "Approve?" prompt and one tap lets you in. Criminals exploit that ease with "push bombing," flooding you with prompts until you tap approve just to make them stop. Never approve a prompt you didn't trigger. Prompts that make you type in a matching number first rank higher with CISA, because a blind tap no longer works.
Strongest: security keys and passkeys. These use FIDO/WebAuthn technology, which CISA calls the gold standard — the only widely available phishing-resistant authentication. A hardware security key is a small device you plug in or tap; a passkey lives on your phone or computer and unlocks with your fingerprint, face, or PIN. There is no code to steal or type into a fake site, and phishing, push bombing, and SIM swap attacks simply don't apply.
Turn It On Tonight: Email First, Then Banking
CISA's priority list starts with email accounts, then financial services, social media, online stores, and gaming and streaming accounts. The switch usually lives in the same place: open the account's Settings, find Security, and look for an option labelled two-factor authentication, two-step verification, or similar. It takes a minute or two to set up, and a few seconds each time you log in.
Don't Skip the Backup
If your phone — your main second factor — is lost or broken, you could lock yourself out of your own accounts. Canada's Cyber Centre advises setting up a backup factor just as strong as your primary one, and having a recovery plan before you need it. When a service offers backup or recovery codes during setup, save them somewhere safe. Future you, locked out at midnight, says thanks.
The Twikup Take
A password is a key anyone can copy. Two-factor authentication is the deadbolt they can't. Turn it on for your email and banking tonight, choose the strongest method each account offers — an authenticator app at minimum, a passkey or security key where you can — and stash those backup codes. Five minutes of setup turns a stolen password into a dead end instead of a disaster.
Image: AI-generated illustration.