The Most Common Ways Accounts Get Hacked

Most hacked accounts are not cracked by someone guessing a clever password. They are opened with a password the attacker already holds: one typed into a fake page, one spilled in an old breach of some other site, or one copied out of a browser by malware. According to the UK’s National Cyber Security Centre (NCSC), the majority of cyber harms to individuals start with criminals stealing or compromising login details.¹

How do accounts get hacked, in practice? Through six routes, each with one main defence. Here they are, roughly from most to least reported:

1. Phishing and fake login pages: sign in only through the app or an address you typed, and use a passkey where offered.
2. Reused passwords: give every account its own password, generated and stored by a password manager.
3. Info-stealing malware: install software only from its maker or an official app store, and keep updates on.
4. Stolen session cookies: keep devices clean, and after any infection reset your passwords, then log out on every device.
5. Weak recovery options: keep the recovery email and phone number on your main accounts current.
6. SIM swaps: put a PIN on your mobile account, and prefer an app or security key to text codes.

Among the cybercrime complaints filed with the US FBI in 2024, phishing and spoofing topped the list with about 193,000 reports, while SIM swaps drew fewer than 1,000.² Several of these defences belong to the basic habits that keep most everyday attacks out; what follows is why each route works, which makes its defence easier to keep.

How do accounts get hacked? Six routes, ranked by how often they appear

The order of the six routes combines US government complaint data, European Union incident data and company threat reports, because no single source counts every account takeover worldwide. Each source sees a different slice of the problem.

The FBI’s Internet Crime Complaint Center (IC3) counts the complaints people choose to file with it, most of them from the US. The EU’s cyber-security agency, ENISA, reviewed incidents affecting EU countries and organizations from mid-2024 to mid-2025, and phishing was the entry route in about 60 percent of the cases it observed.³

Where these sources agree, near the top, the ranking is firm. Lower down it is informed judgement: nobody publishes a count of cookie thefts or recovery-question guesses against households. The routes also overlap, since a phishing email can deliver malware and malware can steal cookies.

So you are not facing six separate problems. Two habits deal with the busiest routes: never type a password into a page you reached from a message, and keep every password unique, so nothing stolen in one place opens another.

Phishing and fake login pages: the route reported most

Phishing works because you hand over the password yourself, on a page built to look like the real one. It needs no break-in at all, only a convincing copy and a message that sends you to it.

An illustrative example reads “Your mailbox is almost full. Sign in to keep receiving email.” The link opens a page with the right logo and the right fields. You sign in, the page sends you on to your real inbox, and nothing seems wrong. The attacker now has a password that works today.

Better-built kits go further. In what security researchers call adversary-in-the-middle phishing, the fake site passes your details to the real service as you type, so it can relay a one-time code from your phone too.⁴ A code alone does not make an account phishing-proof.

Two defences help. The NCSC notes that some password managers recognize real websites and will not fill in your details on fake ones.⁵ Passkeys, which sign you in without a typed password, are highly resistant to phishing, according to the NCSC.¹

Reused passwords: one old leak opens other doors

Reused passwords are the second big route. When any site you use is breached, attackers load the leaked email-and-password pairs into programs that try them automatically on other sites, a technique called credential stuffing.⁶ Microsoft’s 2025 Digital Defense Report says more than 97 percent of the identity attacks its business security tools flagged from April to June 2025 were password spray or brute-force attacks, which keep guessing passwords, often trying common ones against many accounts, and that most attackers exploit weak and overused passwords.⁷

Both techniques rely on the same weakness: a password that is already known or easy to guess, with nothing else in the way. But not every stolen password is equally useful, as a large study of the underground market showed.

The study

Moderate evidence

Where stolen passwords come from, and which ones still work

A team from Google and UC Berkeley in the US monitored the underground trade in stolen logins from March 2016 to March 2017. They found about 1.9 billion usernames and passwords from data breaches, 12.4 million potential victims of phishing kits and 788,000 of keyloggers. Checked against Google accounts, only 7% of breach victims had their current Google password exposed, compared with 12% of keylogger victims and 25% of phishing victims.⁸

Breaches produce the biggest piles of logins, but many are stale; the authors note that many leaks reportedly dated back to 2012 to 2014. A phishing page captures the password in use today, and reuse is what keeps the stale ones dangerous. The study covers Google accounts only, samples the underground market only in part by the authors’ own account, has mostly Google authors, and was funded partly by the US National Science Foundation.

Say a recipe site you joined a decade ago is breached, and you had used the same password for your email. Automated tools test that login against the big email services, and once it works, an intruder can request reset links for everything else from your inbox. The fix is a unique password on every account, which in practice means a password manager that generates them for you.

Info-stealing malware copies what your browser has saved

Info-stealers are malware built to collect usernames and passwords, card details and browser data, including cookies, and send them to criminals, Australia’s ACSC explains. They commonly arrive through phishing texts or emails, online ads with malicious links, and downloads with hidden code.⁹

The scale is large. Between mid-March and mid-May 2025, Microsoft identified more than 394,000 Windows computers worldwide infected by one info-stealer, called Lumma, before it and law-enforcement partners disrupted the tool.¹⁰ That is one product over two months, counting only machines Microsoft could see. ENISA reports that info-stealers kept arriving through cracked software and phishing pages, and through newer tricks such as fake “verify you are human” pages.³

1. 1A risky downloada cracked app, a fake verification page
2. 2The stealer runsoften without any visible sign
3. 3Browser data copiedsaved passwords, cards, cookies
4. 4Logins sold or usedto sign in as you elsewhere

The ACSC’s case files show how ordinary the path can be. At a utility company the ACSC alerted in mid-2024, an employee had probably synced work passwords to a personal Google account by signing in to it on a work computer; when the employee’s personal device was later infected, the malware lifted those work passwords from the browser.⁹ Stolen this way, even a strong password is no protection: the malware takes it whole.

What protects you here is care over what you install. Get software from its maker or an official app store, keep updates on, and treat a free copy of paid software, or a verification page that asks you to download or run anything, as a trap.

Stolen session cookies skip the password and the code

A session cookie is the small token a website stores in your browser after you sign in, so it does not ask again on every visit. Google calls session theft a prevalent threat: malware copies these cookies, and because they often last a long time, attackers can use them to get into accounts without ever needing the password.¹¹

Your password and your second sign-in step were checked once, when you logged in. The cookie is proof that the check already happened, so whoever holds a copy can carry on the session from another computer. A pirated game installer runs on a family laptop, and the stealer inside copies the browser’s cookies. Later someone far away opens your email as if they were you, and no code ever reaches your phone.

Myth

With two-step verification on, nobody can get in without my phone.

Fact

A stolen session cookie shows the sign-in already happened, so it can open an account without the password or the code.

Browser makers are responding. In April 2026, Google began making a feature called Device Bound Session Credentials publicly available in Chrome on Windows, tying a session to a key held in the computer’s hardware so that, on websites that adopt it, copied cookies soon expire.¹¹ Until that protection is widespread, the defence is to keep the device clean. After a suspected infection, once the device is clean and your passwords are changed, log every device and app out of your important accounts; the NCSC says anyone else then has to supply the new password.¹²

Weak recovery options: the side door behind “forgot password”

Account recovery is a second way in. If the “forgot password” route is guarded by an easy question, an old phone number or an email address you no longer control, an attacker can use it instead of your password. A 2015 study of Google’s own data found personal knowledge questions far weaker than ordinary passwords.

A single guess would have matched about a fifth of English-speaking users’ answers to “favorite food”. The questions failed their owners too: about 4 in 10 English-speaking US users could not recall their own answers when they needed them, and Google went on to favor recovery by text message or email.¹³

Answers that seem private are often public. The US Federal Trade Commission warns that an identity thief can find details you post online and use them to answer security questions.¹⁴ Your first school or your pet’s name may be a few scrolls down your own profile.

The practical move is a five-minute check of the recovery email and phone number on your email account, and keeping any recovery codes a service gives you where losing your phone won’t take them too.

SIM swaps: rare, but they turn your phone number against you

In a SIM swap, a criminal persuades your mobile provider to move your number to a SIM card they control, for example by claiming your phone was lost or damaged. From then on your texts and calls, including sign-in codes, go to them, the US Federal Trade Commission explains.¹⁴

The fraudster usually gathers your personal details first, from phishing, breaches or data bought from other criminals. Methods vary by country: in some, including India and Nigeria, the provider asks the customer to approve a swap, so fraudsters try to trick the victim into pressing a key to confirm it, and in other cases attackers have bribed staff at mobile providers.¹⁵

SIM swaps are uncommon but costly. In the FBI’s 2024 report they are among the least-reported crime types, yet those complaints carried about US$26 million in reported losses.² That is why they get attention out of proportion to their numbers: one swap can open bank, email and social media accounts at once.

That advice comes from a US agency. Wherever you live, ask your provider how it guards against unauthorized SIM changes and number transfers, because rules and safeguards differ between countries.

Where the ranking rests on data, and where on judgement

The ranking is firmest at its two ends, phishing and reused passwords at the top and SIM swaps near the bottom of FBI complaints, and weakest in the middle, where nobody counts attacks on households. The table shows what each place rests on, so you can weigh it yourself.

For your own accounts, start where the evidence is firmest and the fixes take minutes.

If one of these routes has already been used on you, start with the provider’s own account-recovery pages, then report any loss to your bank and to your country’s national cybercrime reporting service or the police. Your national cyber-security agency’s website will name the right place.

The bottom line

Attackers rarely need to crack a strong password: they collect one, typed into a fake page or reused from an old leak, or guess a common one. So the two defences with the widest reach are signing in only through routes you started yourself and giving every account its own strong password. After that, install software only from official sources, keep your recovery details current and put a PIN on your phone account.