Six account takeover tactics criminals use beyond stolen passwords Identity thieves increasingly bypass passwords by hijacking login sessions, swapping SIM cards, abusing MFA prompts, spreading malware and tricking users into granting app permissions. Passkeys and other defenses can help, but experts say passwords alone are no longer enough. Criminals increasingly gain access to accounts without stealing a password at all. They may hijack an active login session, convince a user to approve a sign-in, take over a phone number or use malware to harvest data from a device. Passwords remain important, but security experts say they are only one part of the identity protection system. Here are six ways attackers get around traditional password protection and the practical steps consumers can take to stay safe. CyberGuy Kurt Knutsson will host a free live online class on five practical ways to protect your trip and wallet this holiday travel season.Holiday Travel Security Class DetailsParticipants will learn how to secure a phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make travel easier. No technical experience is needed. The class runs Saturday, Oct. 31, at 11 a.m. ET / 8 a.m. PT. Register for free at CyberGuyLive.com.A replay is also available at the same site for those who miss the live session. When you sign in to a website, the service often creates a session confirming you already proved who you are. The browser or app may keep that session active so you do not have to re-enter a password every few minutes. Criminals can sometimes steal the digital tokens or cookies tied to those sessions.If the service accepts the stolen information, an attacker may gain access without entering a password or completing another verification step. Review the devices and active sessions connected to your accounts, sign out of anything unrecognized and check for suspicious login activity. Apple, Google and Microsoft accounts all allow users to review and remove unfamiliar devices. If unauthorized access is suspected, change the password from a trusted device and revoke other sessions when the service allows it.Removing a device from an account list does not always end an active login session. Phone numbers are often linked to email, banking, payment and social media accounts. Criminals may convince a mobile carrier to transfer a number to a SIM card or eSIM they control. If the transfer succeeds, they can receive calls and text messages meant for the victim, including some account verification codes.A sudden loss of cellular service can be an early warning sign, especially when no local outage is known. Other signs include an unexpected carrier notice about a device change or a password-reset message the user did not request. Ask the carrier about an account security PIN, number transfer lock and port-out protection, which vary by provider. For sensitive accounts, use a passkey, security key or authenticator app when available.Combating MFA Fatigue And Push BombingAuthenticator app codes generally do not depend on a phone number. If text messages are the only second authentication method available, keep them enabled because they still beat a password alone. Multifactor authentication adds another layer of protection, but criminals sometimes target the person receiving the security request. One tactic is MFA fatigue, also called push bombing.An attacker who can trigger authentication requests repeatedly sends approval notifications, hoping the victim eventually taps Approve just to make them stop. Criminals may also impersonate technical support or a financial institution and ask the user to read aloud a one-time security code. Never approve a login you did not initiate or share a verification code with someone who contacts you unexpectedly. If repeated prompts appear, deny them and check the account through its official website or app.Change the password if it may be compromised. When available, choose phishing-resistant authentication such as a passkey or security key. App-based approvals that require number matching can also help prevent accidental approvals. An infostealer is malicious software designed to collect information from a device.Depending on its capabilities, it may steal browser-stored passwords, session cookies, payment information or other sensitive data. These programs can arrive through fake downloads, malicious ads or risky browser extensions. Keep the operating system, browser and security software updated. Avoid downloading software from unfamiliar websites and review browser extensions regularly.If malware is suspected, use a separate trusted device to secure important accounts, run a security scan with strong antivirus software and remove suspicious programs. A serious infection may require professional help or reinstalling the operating system. Avoid signing back into sensitive accounts until the device is confirmed secure. Some criminals do not need to steal a password or infect a device.They may trick a user into giving a connected application permission to access information. A fake productivity tool, for example, might ask to read email, access contacts or manage cloud storage files. The permission screen can look legitimate. If access is granted to a malicious app, it may retrieve information through the approved permissions, and in some cases that access continues even after the account password is changed.Understanding OAuth Consent Phishing AttacksThis technique is sometimes called OAuth consent phishing. In a September 2026 warning, the FBI explained that criminals can trick people into granting malicious applications access to their accounts, and that access can remain active after a password change unless the victim revokes the app permissions. Review third-party applications connected to Google, Microsoft and other important accounts, examine what each app can access and remove permissions for apps that are unused or unrecognized.Be especially careful with apps requesting access to email, contacts, cloud files or account management features. Passkeys can significantly reduce the risk of traditional password phishing. They use cryptographic credentials tied to a device, security key or password manager. Unlike a password typed into a website, a properly implemented passkey is linked to the legitimate site or service, making it much harder for a fake login page to steal the credential.Passkeys do not eliminate every risk. Criminals may still target an already authenticated session, an infected device, a malicious connected app or an account recovery process. Use passkeys when important accounts support them, protect devices with a strong screen lock and keep recovery information current. If a service offers backup recovery codes, store them securely so access can be regained if a primary device is lost or damaged.Changing a compromised password matters, but it may not automatically remove every form of unauthorized access. Some services revoke existing sessions after a password change, while others require signing out of devices separately. A criminal might also have established another route into an account, such as an app-specific password or an unauthorized connected application, so a full security review is essential.