Ask most people how a password gets stolen and they picture someone furiously typing until they crack it. That almost never happens. Real password theft is quieter, cheaper, and usually does not involve attacking you at all.
Here are the six ways it actually happens, ordered roughly by how common they are, and what genuinely stops each one.
1. Your password leaked from somewhere else
This is the big one, and it has nothing to do with your security habits on the site being attacked.
A company you signed up to years ago gets breached. Their database of emails and passwords ends up circulating online. An attacker takes that list and tries the same combinations on hundreds of other services — your email, your bank, your social accounts. If you reused that password anywhere, they are now in.
Taking username and password pairs leaked from one breach and automatically trying them on many other sites. It works because most people reuse passwords. No hacking of the target site is required at all.
What stops it: never reusing a password. That is the entire defence, and it is why password managers matter more than password complexity.
2. You typed it into a page that was not real
A convincing email, a link, a login page that looks exactly right. You type your password. The page thanks you and forwards you to the real site, so nothing feels wrong.
Modern phishing has no spelling mistakes and often references real invoice numbers, real colleagues and real suppliers. Confidence that you would spot it is not protection — in real-world tests, roughly a third of staff click.
We walk through exactly how one of these emails is built and why it works in our free Introduction to Cyber Security course, where you follow a single real-world style breach from the first click to the final bill.
What stops it: never reaching a login page through a link in a message. Type the address yourself or use your own bookmark.
3. It was guessable
Attackers do not guess randomly. They use lists of the most common passwords, plus your public details — pet names, birth years, favourite team, town. All of that is usually on your own social media.
Adding a number and an exclamation mark to a dictionary word does not help as much as you think. Length beats complexity: a long passphrase of unrelated words is far harder to crack than a short scrambled one.
Attackers rarely guess against the live website, because it locks them out. They guess offline, against a stolen password database, at millions of attempts per second. That is why the strength of your password still matters even when the site has rate limiting.
4. Malware on your device captured it
Infostealer malware sits quietly on a machine and harvests saved browser passwords, session cookies and anything typed. It usually arrives through pirated software, fake installers, or a malicious attachment.
What stops it: automatic updates, not installing cracked software, and being suspicious of unexpected attachments.
5. Someone intercepted it
This one is far less common than it used to be. Almost all sites now use HTTPS, which encrypts traffic in transit, so a stranger on the same coffee-shop Wi-Fi cannot simply read your password out of the air.
It still matters on sites without HTTPS, and it is worth checking that the address begins with https:// before logging into anything. You can inspect a site’s details using the free BitCops security tools.
6. Someone simply asked
A phone call claiming to be IT support. A message from a colleague’s hacked account. A helpful person on a support desk resetting an account for someone who sounded convincing.
This is social engineering, and it defeats every technical control you own, because nothing was technically broken. Somebody was persuaded.
What stops it: verifying unusual requests on a second channel you chose yourself. Phone a number you already had, not one from the message.
How to check whether you are already exposed
Assume at least one of your passwords is already in a leaked database somewhere — for most people it is true. Two practical checks:
- Search your email address on a reputable breach-notification service to see which breaches included you.
- Open your email account’s security settings and review recent sign-in activity, forwarding rules and mailbox rules. Attackers hide there, because it survives a password change.
The short version
If you only do three things:
- Turn on multi-factor authentication on your email first. Your email resets every other account you own, which makes it the master key. With MFA on, a stolen password is usually not enough.
- Stop reusing passwords. Use a password manager and let it generate them.
- Slow down when a message creates urgency. Urgency is the tool, not the emergency.
None of that costs money. Nearly every breach we study could have been stopped by that list.
Want to see this happen for real?
Our free Introduction to Cyber Security course follows one small clinic through a complete breach — the research, the phishing email, the stolen password, and everything that followed. Written for total beginners. No coding required.
Stuck on something? Ask in the BitCops community or start a thread on the forum.
TAGS
password securitycredential stuffingphishingmulti-factor authenticationpassword managercyber security for beginnerssocial engineeringdata breachonline safetyinfostealer malware