Even a complex password does not guarantee protection against hacking: how scammers bypass security

Even a complex password does not always protect your account from hacking, Denis Sinyukov, an engineer, application architect, specialist in corporate IT systems, fintech development and business process automation, warned Full Stack. He explained in a conversation with Lenta.ru how fraudsters gain access to accounts with seemingly reliable protection.

The idea that hackers manually select a password is long outdated, the expert said.

According to the expert, passwords most often get to scammers in several ways. One of the most common is phishing sites that imitate the pages of banks, postal services, marketplaces or social networks. So, the user enters the data himself, thinking that he is on a real resource.

Another channel is database leaks: if the service did not protect user information well, the data may end up in the public domain or on shady sites, Lenta.ru’s interlocutor warned.

Infected devices pose a separate threat, the expert noted. Malware can read keystrokes, intercept browser data or access saved accounts, he said.

The expert named using the same password on different services as the most dangerous habit. If data has leaked from an insignificant site, attackers can automatically check the same login and password pair in mail, banks, cloud storage and personal accounts, he explained.

Sinyukov noted that it is most reliable to use a unique password created by a password manager for each service. The expert also recommended enabling two-factor protection at least in mail, banking services, marketplace accounts and social networks. In addition, he advised regularly updating the operating system and applications, not following suspicious links, not storing passwords in notes and instant messengers, and not entering credentials on sites whose address is questionable.