Identity thieves don’t need your password anymore

You may think of a stolen password as the main way someone gets into your account. But online criminals have learned that they do not always need to steal the password itself. They may hijack an active login session, convince you to approve a sign-in, take control of your phone number or use malware to collect information from your device.

Passwords are still important. However, they are only one part of the security system protecting your identity. Here are five ways criminals may try to get around traditional password protection and the practical steps you can take to protect yourself.

1. Stolen login sessions

When you sign in to a website, the service often creates a session that tells it you have already proved who you are. Your browser or app may keep that session active so you do not have to enter your password every few minutes. Criminals can sometimes steal the digital tokens or cookies associated with these sessions. If the service accepts the stolen information, an attacker may gain access without entering your password or completing another verification step.

How to protect yourself: Review the devices and active sessions connected to your accounts. Sign out of anything you don’t recognize and check for suspicious login activity. We’ve previously explained how to check for unfamiliar devices and remove them from your Apple, Google and Microsoft accounts. If you suspect unauthorized access, change your password using a trusted device and revoke other sessions when the service allows it. Remember that removing a device from an account list does not always terminate an active login session.

2. SIM swaps and phone account fraud

Your phone number is often connected to email, banking, payment and social media accounts. Criminals may try to convince a mobile carrier to transfer your number to a SIM card or eSIM they control. If the transfer succeeds, they may receive calls and text messages intended for you, including certain account verification codes. A sudden loss of cellular service can be an early warning sign, especially when there is no known local outage. Other signs include an unexpected carrier notification about a device change or a password-reset message you did not request.

How to protect yourself: Ask your carrier about an account security PIN, number transfer lock and port-out protection. These protections vary by carrier. For sensitive accounts, use a passkey, security key or authenticator app when available. Unlike texted verification codes, authenticator app codes generally do not depend on your phone number. If text messages are your only available second authentication method, keep them enabled. They still provide more protection than relying on a password alone.

3. Fake login approvals and MFA fatigue

Multifactor authentication, or MFA, adds another layer of protection to your accounts. However, criminals sometimes target the person receiving the security request. One tactic is MFA fatigue, also called push bombing. An attacker who can trigger authentication requests repeatedly sends approval notifications, hoping you eventually tap “Approve” to make them stop. Criminals may also impersonate technical support or a financial institution and ask you to read aloud a one-time security code.

How to protect yourself: Never approve a login you did not initiate or share a verification code with someone who unexpectedly contacts you. If repeated prompts appear, deny them and check the account through its official website or app. Change your password if you suspect it has been compromised. When available, choose phishing-resistant authentication, such as a passkey or security key. App-based approvals that require number matching can also offer additional protection against accidental approvals.

4. Malware and risky browser extensions

An infostealer is malicious software designed to collect information from a device. Depending on its capabilities, it may steal browser-stored passwords, session cookies, payment information or other sensitive data. These programs can arrive through fake software updates, pirated applications, suspicious email attachments, malicious advertisements or compromised browser extensions. Some malware operates quietly, which means you may not immediately notice anything unusual.

How to protect yourself: Keep your operating system, browser and security software updated. Avoid downloading software from unfamiliar websites and review browser extensions regularly. If you suspect malware has compromised a device, use a separate, trusted device to secure important accounts. Run a security scan with strong antivirus software and remove suspicious software. For a serious infection, professional assistance or reinstalling the operating system may be necessary. Avoid signing back into sensitive accounts until you are confident the device is secure.

5. Malicious apps with access to your accounts

Some criminals do not need to steal your password or infect your device. Instead, they may trick you into giving a connected application permission to access your information. For example, a fake productivity tool might ask to read your email, access your contacts or manage files in your cloud storage. You may encounter a legitimate-looking permission screen asking you to approve those requests. If you grant access to a malicious app, it may be able to retrieve information through the permissions you approved. In certain cases, that access can continue even after you change your account password. This technique is sometimes called OAuth consent phishing. In a September 2026 warning, the FBI explained that criminals can trick people into granting malicious applications access to their accounts. That access can remain active even after a password change unless the victim revokes the application’s permissions.

How to protect yourself: Review the third-party applications connected to your Google, Microsoft and other important accounts. Look closely at what each application can access. Remove permissions for apps you no longer use or do not recognize. Be especially careful with applications requesting access to email, contacts, cloud files or account management features.

Passkeys can help, but they are not the whole answer

Passkeys can significantly reduce the risk of traditional password phishing. They use cryptographic credentials associated with your device, security key or password manager. Unlike a password that you type into a website, a properly implemented passkey is tied to the legitimate website or service. That makes it much harder for a fake login page to steal the credential. However, passkeys do not eliminate every security risk. Criminals may still target an already authenticated session, an infected device, a malicious connected application or an account recovery process.

How to protect yourself: Use passkeys when your important accounts support them. Protect your devices with a strong screen lock and keep recovery information current. If a service offers backup recovery codes, store them securely so you can regain access if your primary device is lost or damaged.

Why changing your password may not be enough

Changing a compromised password is important, but it may not automatically remove every form of unauthorized access. Some services revoke existing sessions after a password change, while others require you to sign out of devices separately.

A criminal might also have established another route into your account, such as an app-specific password, an unauthorized connected application or a new recovery method. Your email deserves particular attention. Someone with access to your inbox could create forwarding rules that quietly send copies of your messages elsewhere.

Review security settings for unfamiliar recovery addresses, connected devices, forwarding rules and app permissions. Remove anything you did not authorize. Also, check whether your password was reused elsewhere. If it was, replace those passwords with unique credentials. A password manager can make this easier without requiring you to memorize every login.

What to do if someone gets around your password

If you suspect an account takeover, act quickly. Start with the account that controls access to your other accounts, usually your primary email.

Here’s where to focus:

• Secure your email: Use a trusted device to change your password, revoke suspicious sessions and check recovery information.
• Review connected apps: Remove unauthorized permissions and app-specific passwords.
• Check your phone account: Contact your mobile carrier immediately if you suspect a SIM swap or unauthorized number transfer.
• Protect financial accounts: Review recent transactions and contact your bank or card issuer about suspicious activity.
• Watch for identity theft: Examine your credit reports for unfamiliar accounts or inquiries. Consider placing a fraud alert or credit freeze.
• Preserve evidence: Save security alerts, screenshots, transaction records, case numbers and dates of conversations with financial institutions.

A credit freeze is free and can help prevent criminals from opening new credit accounts in your name. You must contact all three major credit bureaus, Equifax, Experian and TransUnion, to freeze your reports at each bureau. If you believe someone has stolen your identity, visit IdentityTheft.gov for a personalized recovery plan from the Federal Trade Commission.

The value of watching beyond the login

Strong account security is essential, but identity misuse can happen outside the original account. A criminal might use exposed personal information to apply for credit, take over a mobile account or attempt financial fraud without triggering a traditional password alert. That’s where an identity theft protection service may provide another layer of monitoring.

LifeLock offers identity monitoring, certain financial account alerts and restoration assistance. Depending on the plan, it may identify suspicious activity that deserves closer investigation. If identity theft occurs, restoration specialists can help eligible members work through the recovery process. However, monitoring cannot prevent every attack or guarantee that fraudulent activity will be detected immediately.

LifeLock plans to compare

LifeLock Core: Offers up to $1.05 million in combined identity theft coverage, including up to $1 million for lawyers and experts, plus up to $25,000 each for stolen funds and personal expenses. It also includes identity monitoring, financial activity alerts for up to two accounts, two-bureau credit monitoring, credit and payday loan lock features and automatic data broker removal.

LifeLock Advanced: Provides up to $1.2 million in combined identity theft coverage, including up to $100,000 each for stolen funds and personal expenses. It adds three-bureau credit monitoring, financial activity alerts for up to five accounts and up to $5,000 in eligible scam reimbursement.

LifeLock Total: Offers up to $3 million in combined identity theft coverage, including up to $1 million each for stolen funds, personal expenses and lawyers and experts. It also includes monitoring alerts for unlimited eligible financial accounts, three-bureau credit monitoring, home title monitoring, 401(k) and investment account alerts and up to $10,000 in eligible scam reimbursement.

All three plans include access to U.S.-based identity restoration specialists.

Pro tip: Protect the accounts that unlock everything else

Once a month, review active sessions for your main email and financial accounts. Remove devices you no longer use and check whether your recovery information or connected app permissions have changed. Pay attention to unexpected login alerts, changes to your mobile account and new financial activity. A short monthly security check can help you spot suspicious changes before they become a larger problem.

Related Links:

• SIM swap scam warning: What to do if your phone loses service
• How to find compromised passwords on iPhone and Android
• Are bank text codes enough to protect you?

Kurt’s key takeaways

For years, I’ve told people to use strong passwords and turn on two-factor authentication. I still stand by that advice. But what concerns me now is how criminals can get into accounts without ever knowing the password. Think about someone quietly reading your email through a connected app you forgot about or using a stolen login session to access information you’ve worked hard to protect. You might change your password and assume everything is fine, while that access remains open. That’s why I recommend checking which devices and apps have access to your most important accounts. Start with email and your mobile carrier because losing control of either can create problems across your financial accounts. And while identity theft monitoring services such as LifeLock can help alert you to certain suspicious activity, they work best alongside strong account security. A few minutes reviewing your settings today could save you a great deal of trouble later.

Have you ever received a login approval or password-reset request you didn’t initiate, and did you take action or ignore it? Let us know in the comments below.

FOR MORE OF MY TECH TIPS & SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE

We created this article in partnership with LifeLock

Copyright 2026 CyberGuy.com.  All rights reserved.  CyberGuy.com articles and content may contain affiliate links that earn a commission when purchases are made.