Password managers and MFA

Your two standing defences

This whole module has been about attacks aimed at you, the person: phishing, smishing and vishing, a fake supplier invoice, a caller who "just needs your password". Two tools stand between those attacks and your accounts: a password manager and multi-factor authentication (MFA). The everyday mechanics of both, how to build a strong password, how a manager stores it, how MFA adds a second step, are covered in the basics lesson Passwords and MFA. Here we look at them from the attacker's side, because each one quietly defeats a trick you have just met.

A password manager refuses the fake page

You already know a password manager ends the reuse problem, giving every account its own strong password so one leak cannot spread. Against social engineering it has a second, sharper benefit that is easy to miss.

A manager fills your login only on the exact web address it saved. Land on a look-alike phishing page, an address one letter off from your bank, and the manager simply stays silent. That silence is itself a warning: if the password you expect does not autofill, you may be on a fake site. Software compares the address character by character, which a rushed human eye, reading under pressure, often will not. In effect the manager checks the very thing the attacker is counting on you to skip.

MFA survives a stolen password

Look back at the attacks in this module and notice what they are all ultimately after: your password. A convincing email, a calm phone call, a pixel perfect login page, each is just a way to get you to say it or type it. MFA is built for exactly that moment. It assumes the password can be phished and puts a second lock behind it, usually something you physically have, like a code or a tap on your phone.

So even when a social engineer succeeds in getting your password, they are stopped at the second step, because they do not have your phone. That is why MFA is the single most valuable habit against everything this module describes. Turn it on wherever it is offered, starting with email, since your email can reset the password on almost everything else.

An unexpected prompt means you have been phished

MFA also gives you a live alarm. If your phone asks you to approve a login that you did not just start, the most likely explanation is that someone already has your password, from a leak or a phishing message, and is trying it right now.

Bringing the module together

The thread through this whole module has been one habit: slow down, and verify anything unexpected through a separate, trusted channel before you act. A password manager and MFA are the standing version of that habit, working even in the moment you are fooled. The manager quietly refuses the fake page, and MFA holds the line after a password is gone. Together they turn a successful trick into a near miss.

Check yourself