Stolen Password: How Attackers Still Get In

If an attacker has your password, they can often log in even if you change it, because many accounts accept alternate authentication methods—like session cookies, OAuth tokens, or recovery questions—that the thief also captured. This article explains the technical paths a stolen password opens, why changing it alone may not be enough, and what you can do to actually lock the door.

What a Stolen Password Actually Gives an Attacker

A password is just one key to your account. Modern authentication systems use a chain of credentials: the password itself, a session token (a small file or string that proves you are logged in), and often a refresh token that issues new session tokens. When an attacker steals your password, they often also grab these tokens from the same breach, phishing page, or malware infection. Even if you reset the password, those tokens remain valid until they expire—sometimes for weeks or months.

Additionally, many people reuse passwords across sites. A stolen password from one service can be tried on email, banking, and social media accounts. This is called credential stuffing, and it works because password reuse is extremely common. Even if you don’t reuse the exact password, attackers use automated tools to try variations (adding a number, capitalizing the first letter) against other sites.

How Attackers Get Your Password in the First Place

There are several common ways, and understanding them helps you know what to protect against:

Phishing: A fake login page that looks like your bank or email provider. You type your password, and it goes straight to the attacker.
Data breaches: A company you use has a security incident, and its user database (including password hashes) is leaked. Attackers then crack weak hashes or use the plaintext if the company stored it poorly.
Malware: Keyloggers or info-stealer trojans record everything you type, including passwords, and send them to a remote server.
Password reuse: An attacker already has your password from one breach and tries it on other sites.
Social engineering: An attacker calls your ISP or email provider, pretends to be you, and convinces a support agent to reset your password.

Once an attacker has the password, they move fast. They often log in immediately, change the password to lock you out, and set up their own recovery options (like a new email or phone number) so you cannot regain access.

Why Changing Your Password May Not Be Enough

If an attacker has already logged in, they may have established persistence mechanisms that survive a password reset:

Session cookies: These are stored in your browser and tell the server you are authenticated. Even after you change your password, the old session cookie often remains valid until it expires or is revoked. An attacker who copied that cookie (via malware or browser sync theft) can continue to use it.
OAuth tokens: If you used “Sign in with Google” or “Sign in with Facebook” on a third-party site, that site has a token that lets it act on your behalf. Changing your password on the identity provider does not revoke that token; you must revoke it manually in the third-party app’s settings.
Recovery options: If the attacker added their own email or phone number to your account, they can reset your password again later. You must remove those recovery options after you regain control.
App-specific passwords: Some services (like Google and Microsoft) allow you to generate separate passwords for apps that don’t support two-factor authentication. These are not changed when you change your main password; you must revoke them individually.

This is why security experts recommend that after a suspected compromise you not only change the password but also log out of all devices, revoke all sessions, and review recovery options.

What Two-Factor Authentication (2FA) Does and Doesn’t Do

Two-factor authentication (2FA) adds a second check—usually a code from an app, a text message, or a hardware key—after you enter the password. This blocks many attacks because the attacker would need both the password and the second factor. However, 2FA is not foolproof:

Phishing can bypass 2FA: A sophisticated phishing site can intercept the password and the 2FA code in real time (a technique called “man-in-the-middle” or “AiTM” phishing). The attacker uses the code immediately before it expires.
SIM swapping: If your 2FA uses SMS, an attacker can convince your mobile carrier to transfer your phone number to a SIM card they control, then receive your codes.
Recovery codes: Many services provide backup codes when you set up 2FA. If an attacker steals those (e.g., from a compromised email or cloud storage), they can bypass 2FA.

Despite these gaps, 2FA still stops the vast majority of automated attacks. It is far better than no 2FA, but you should treat it as a strong layer, not an absolute guarantee.

How to Recover a Hacked Account

If you suspect your account has been compromised, act quickly and follow these steps (specifics vary by service):

Try to log in with your current password. If it fails, use the “Forgot password” link and follow the service’s recovery flow (often via email or phone).
Once you regain access, change your password to a new, strong, unique one. Do not reuse an old password.
Log out of all other sessions. Most services have a “Sign out of all devices” option in security settings.
Review and remove any unknown recovery options—email addresses, phone numbers, or security keys that you didn’t add.
Check for connected apps (OAuth authorizations) and revoke any you don’t recognize.
Enable two-factor authentication if you haven’t already, and set up a hardware key or authenticator app instead of SMS if possible.
Scan your devices for malware with a reputable security tool, especially if the breach may have come from a keylogger.

After recovery, monitor your account activity for a few weeks. Many attackers wait before using the account again.

How to Prevent a Stolen Password from Working

The most effective way to stop a stolen password from granting access is to make it useless on its own. Here’s what works:

Use a unique password for every site. A password manager (like Bitwarden, 1Password, or KeePass) generates and stores strong random passwords. Then a breach on one site doesn’t affect any other.
Enable two-factor authentication everywhere it’s available. Prefer an authenticator app or hardware key over SMS.
Use a passkey (FIDO2) when offered. Passkeys replace passwords entirely with a cryptographic key that never leaves your device, so there is no password to steal.
Watch for phishing. Always check the URL before typing your password. Use a browser extension that blocks known phishing sites.
Keep your software updated to patch vulnerabilities that malware exploits.

If a service offers “security keys” (like YubiKey), they are the strongest protection because they require physical possession of the key and cannot be phished.

Frequently Asked Questions

Can someone log in with my password if I’ve already changed it?

Yes, if they have a valid session cookie or OAuth token. Changing the password does not revoke those. You must explicitly log out of all sessions and revoke third-party access.

What is the difference between a session cookie and a password?

A password is your long-term credential. A session cookie is a short-term proof that you are logged in on a specific device. If an attacker steals the cookie, they can impersonate you without needing the password.

Does two-factor authentication protect against credential stuffing?

Yes, in most cases. Credential stuffing uses stolen passwords to try to log in. Without the second factor, the attacker cannot complete the login. However, if the attacker also has a valid session token, they may not need to log in at all.

What should I do if I used the same password on multiple sites?

Change that password immediately on every site where you used it. Start with your email, banking, and social media accounts. Then set up unique passwords for each site using a password manager.

Why do attackers want my account even if it has no financial value?

Accounts are valuable for many reasons: sending spam, spreading malware, impersonating you to scam your contacts, or using your email to reset passwords on other services. Even a low-value account can be a stepping stone.

Is it safe to use a password manager?

Yes, password managers are widely recommended by security experts. They store your passwords in an encrypted vault, and you only need to remember one master password. The risk of a single master password being stolen is far lower than the risk of password reuse.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →