Everyone knows that passwords are a prime target for hackers and identity thieves. Not everyone knows how their passwords are actually stolen, though. Understanding the tactics, scams, and other ways that cybercriminals pilfer these digital keys to unlocking valuable personal information can reduce your risk of identity theft and fraud.
It’s also important to realize how significant of a role that passwords play in our digital lives. Recent studies show that the average person today has around 100 passwords or at least 100 different accounts with password access. These passwords are spread across numerous platforms including everything from social media to streaming services to financial institutions. You might not think that every account you hold is of equal importance or risk, but unless you have unique passwords for each, a single piece of stolen information can result in a string of potential fraud-related issues.
Let’s dive into how hackers steal your passwords to give you a better look into a better understanding of what’s at stake and where you might benefit from additional attention to arrive at more secure habits or measures.
Data Breaches
One common way that criminals gain access to your password is through no fault of your own. Data breaches involving the companies and platforms that store your passwords and other information are a widespread problem with no real solution in sight. Bad actors can steal thousands, even millions, of passwords and other information by targeting larger companies that store vast amounts of consumer data. The criminals the use this coveted information to commit many types of fraud.
The average consumer is becoming more aware of how corporate data breaches can affect them. Regulations also require affected organizations to inform individuals when their information has been compromised in a data breach. Once criminals are equipped with a treasure trove of passwords from a data breach, they often attempt credential stuffing attacks. This involves seeing if the stolen credentials can be used to open other password-protected accounts. They use software to scour sites and generate automated attempts to gain access – another reason why using unique passwords is so important.
Phishing
Phishing is a tried-and-true tactic that hackers have used for years because it is still often highly effective. A common form of phishing appears to the target victim as an authentic-looking email from a supposedly credible source asking you to verify your login information or account details. These messages can also occur through a phone call or text, then known as vishing and smishing, respectively.
Phishing attacks prey on our natural tendencies to trust a message from someone or some entity with who/which we are already familiar. They also attempt to force us into acting quickly by stirring up an emotional trigger. This can be seen in phishing attempts that ask you to verify your login and password because it has supposedly been compromised or spoofing a message from a boss or family member to get you to reveal personal information.
On top of flat out asking you to reveal your information, phishing attacks can also include links that will install malicious code onto your device. This brings us to the next password stealing method:
Malware
Malware is any type of malicious code or software that gets unknowingly and unwantedly installed on a network or device. Hackers can utilize malware for many different purposes, but malware serves as an easy way to steal passwords and other personal information. This code can easily go unnoticed on your phone or computer and track your keystrokes or send screenshots of your device directly to the cybercriminals who installed it.
If you click on a random link in an untrusted email or visit an unsecured website, malware infection is always a risk. It can also be hidden within questionable apps that may look authentic. Avoid clicking on email links, submitting any information to suspicious-looking websites, and downloading apps from third-party app stores to help limit the risk of malware infection.
Cracking Easy Passwords
This one might sound far-fetched, but it happens more than you might think – sometimes cybercriminals simply guess your password. The most used passwords are obviously the easiest to figure out. If you are in the habit of using 123456, abc123, or even ‘password’, you can expect to have issues sooner than later if you haven’t already. Threat actors realize that millions of people don’t put any effort into creating a secure password. Those simple passwords might be easy to remember, but they are nearly as easy for criminals to figure out.
Using complex passwords is one way to thwart this issue. You might need to use a password manager to remember it, but it makes things much more difficult and time-consuming for hackers to figure out. Long passwords are harder to crack than are shorter passwords, you’re your using a phrase from a song or quote you like can help you remember it. 12-15 characters is usually the minimum recommended password length, but the longer, the better.
Lurking in the Shadows
A sophisticated cyber-scheme isn’t always necessary to steal your password. Sometimes criminals can be sitting right next to you at the café or airport, scouring screens for personal information. If you aren’t careful with your habits, they might be able to catch your password as you type it. And even if you are careful, using a public Wi-Fi network can give hackers easy access to all of the devices connected to it.
Be wary of signing into any major digital accounts when you are in public, and always try to avoid prying eyes if you do. Make sure to keep your passwords in hidden mode so a fraudster can’t see it outright or snap a picture. Better yet, try to limit entering login and password information in public settings altogether.
The Bottom Line
Even though authentication technologies are improving, passwords are here to stay for the time being. The more aware you are of how this critical information can be stolen, the better able you will be at limiting the risk of having yours stolen. The reality is that data breaches and other issues may be out of your hands to a degree but staying ahead of the curve by adopting good password habits is still highly recommended.
LibertyID provides expert, full service, fully managed identity theft restoration to individuals, couples, extended families* and businesses. LibertyID has a 100% success rate in resolving all forms of identity fraud on behalf of our subscribers.
*LibertyID defines an extended family as: you, your spouse/partner, your parents and parents-in-law, and your children under the age of 25.