Why Strong Passwords Still Get Hacked, and What Helps First

Say Kabir has a good password for his email: fourteen characters, nothing guessable, never written down. A hacker takes over the account anyway, and Kabir never learns why. He hadn't done anything wrong, if "wrong" means "weak".

The password was fine. It's just that guessing the password is one of the least common ways into an account. Attackers go for the cheaper routes, and most of those never touch password strength at all. Here's what the cheaper routes are, then what to do about them, ordered by how much each fix buys you.

Route one: the password was somebody else's problem

Suppose Kabir used that same password, years ago, for a small food-delivery site. That site gets breached, and its database of emails and passwords ends up for sale or free. Nobody needs to crack anything now. The attacker has the real password in plain text, or a hash that is easy to reverse for the common cases.

The next step is called credential stuffing: software takes each leaked email and password pair and tries it, automatically, on banking sites, email providers, shopping apps and social networks. It doesn't guess. It replays. If Kabir reused the password, it works on the first try, and the strength of the password didn't matter, because it was already known.

This is why reuse is the heaviest single risk for people who otherwise do everything right. A unique password per site turns a breach at one company from "my accounts are gone" into "I change one password". You can check whether your email appears in known public breaches at Have I Been Pwned, a long-running service run by security researcher Troy Hunt.

Route two: Kabir typed it in himself

Phishing is when a message or a page tricks you into entering your credentials on a site the attacker controls. A text that says your electricity will be cut tonight unless you update your details at a link. An email styled like your bank's, or a "your account will be blocked, verify KYC" message. The fake page looks right, and you type your username, password and, often, the OTP that arrives next. The attacker is typing them into the real site at the same moment.

Strong passwords do nothing here. You handed it over. The password manager helps in a quiet way: it fills in credentials only on the exact web address saved for that site, so on a lookalike domain it stays blank. If your manager doesn't offer to fill in, that's a signal, not an inconvenience.

Route three: malware that reads what your browser remembers

Infostealer malware is a class of program built to quietly collect saved passwords, browser cookies and sometimes cryptocurrency wallet files from an infected device, and send them to the attacker. A common way in is software that someone downloaded from an unofficial source: cracked versions of paid programs, game cheats, a "free" video editor from a link in a video description.

The nasty part is the session cookie. That's the small token which tells a website you've already logged in. Steal it and an attacker can sometimes be treated as you without ever typing a password or a 2FA code. So a long password and an authenticator app might not help on an infected machine.

The fix is dull. Install software from official stores and the vendor's own site, keep the operating system and browser updated, use the built-in antivirus, and don't run files that arrived by chat. If you suspect a device is infected, change your passwords from a different, clean device, and sign out of all sessions where the service lets you.

Route four: the phone number is the weak link

In India, so much runs through a mobile number that it deserves its own warning. Bank OTPs, UPI registration, WhatsApp, and password resets all land on it. Two attacks aim at that.

SIM swap. The fraudster convinces a mobile operator, with forged papers or inside help, to issue a duplicate SIM for your number. Your phone suddenly loses signal and theirs starts receiving your OTPs. A sign to watch for: your SIM stops working for no reason, especially if it's followed by messages you didn't expect. Call your operator straight away from another phone.

OTP scams. No technology is needed. A caller claims to be from your bank, a courier, an electricity board or "KYC verification", creates urgency, and asks you to read out the code that just arrived or to install a remote-access app so they can "help". The OTP is the key to the transaction, and you've given it away. The rule that covers nearly all of these: no genuine bank, UPI app or government service needs your OTP, PIN or CVV to give you money or to verify you over a call. Receiving money never needs your PIN.

If you've lost money to fraud, report it on the helpline 1930 or at cybercrime.gov.in, and tell your bank at once. Speed matters because it can help in freezing funds. The Sanchar Saathi portal run by the Department of Telecommunications lets you see which mobile connections are registered in your name and report ones you don't recognise.

Route five: the security question is public

"What is your mother's maiden name? Which school did you attend? Where were you born?" Those answers can often be found from a social profile, a school alumni page or a relative's post. Anyone who knows you, and plenty who don't, can answer them. A recovery question is a second password, but a much weaker one.

When a site makes you pick one, don't answer truthfully. Type a random string, or a random word pair, and save it in your password manager with the account entry. It sounds silly until you realise the real answer is on your cousin's wedding album caption.

Recovery email and phone number need the same care. Whoever controls those controls the account, so keep them current and keep them protected.

What to do, in order of payoff

I'd rank fixes by how many of the five routes each one blocks, and by effort.

1. Secure your main email first. Unique, long password, and two-factor on. Every other account's reset link goes there. One account, all five routes closed or narrowed.
2. Stop reusing passwords. A manager does the work. It closes route one completely and helps against route two. This is the biggest gain for the least thinking. The guide to building strong passwords explains the maths, and the password generator will make the first batch.
3. Use an authenticator app or passkey instead of SMS where you can. It reduces SIM-swap damage. Passkeys also resist phishing.
4. Add a PIN or lock with your mobile operator and bank where offered, and check Sanchar Saathi once. Takes five minutes.
5. Treat urgency as the warning. Hang up, close the page, and reach the organisation through the number printed on your card or on their official site. Never through a link or number you were handed.
6. Keep devices clean. Official app stores, updates, no cracked software.
7. Replace truthful recovery answers with random ones. Do it next time you open an account's security settings.

The order is a judgement, not a measurement. If you often download unofficial software, item six moves up. If you live a life with UPI at every counter, item four moves up. Adjust it to your habits.

What this can't promise

None of these steps makes you immune. A determined attacker targeting a specific person is a different problem from automated mass attacks, and the people at highest risk, such as journalists, activists or senior executives, need stronger measures than this list. For everybody else the point is simple. You don't need to be unhackable. You need to be harder than the next account on the list, and doing the first three items puts you there.