Your two-factor was on. They got in anyway.

By Leonel Lordeus · Lordeus Pro · 5 min read

A business owner told me, with real confidence, that his email couldn't be broken into because he had two-factor turned on. A few weeks later it was broken into. He kept coming back to the same thing: the two-factor was on, he was sure of it, so how. He wasn't wrong about the two-factor. He was wrong about what it protects.

This is the most common surprise I run into, and it catches careful people, not careless ones. The careless ones never turned two-factor on in the first place. This happens to the business that did everything it was told.

What two-factor actually checks

Two-factor checks you at the door. You put in your password, then you prove it's really you with a code or a tap on your phone, and the system lets you in. Good. That's a real lock, and it stops the oldest trick in the book, which is someone typing a stolen password.

Here's the part nobody explains. Once you're in, the system doesn't make you do that again on every click. That would be unbearable. So it hands your browser a token - think of it as a wristband. For the next while, you flash the wristband and you're waved through without anyone checking the door again. That's why you're not entering a code every time you open your inbox.

The attacker isn't trying to pick the lock anymore. They're trying to steal the wristband.

How they steal it

The usual way is a fake login page that sits in the middle. You get an email - a shared document, a voicemail, a "your mailbox is full" warning - and it takes you to a page that looks exactly like the Microsoft or Google sign-in, because it's quietly passing everything you type to the real one in real time. You enter your password. The real site asks for your two-factor code. You enter that too, on your real phone, and it works, because it's a real login. You're in. So is the page in the middle, and on the way through, it grabbed the wristband.

From that point the attacker doesn't need your password and doesn't need your phone. They have the token, and the token says the two-factor already happened. As far as your email is concerned, they're you, and they've been you for days.

The other way is a piece of malware on one computer that reads the tokens straight out of the browser. Same result, no fake page needed.

Why resetting the password doesn't fix it

This is the trap, and it's where most small businesses lose the extra week. Something feels off, so the owner changes the password. Sensible. It also does nothing to the attacker, because the attacker never had the password and isn't using it. They're riding the wristband, and changing the password doesn't take the wristband back.

The step that actually works is signing out every session and revoking those tokens - forcing every device, everywhere, to log in fresh. In Microsoft 365 and Google Workspace that's a specific button, and it's not the password-reset button. If you only reset the password, you've changed the lock on a door the intruder already walked through, while they sit inside reading your mail.

What actually helps

You can't un-invent this, but you can make your business a bad target and a fast cleanup.

• Phishing-resistant sign-in. Passkeys and hardware security keys don't hand anything to a page in the middle, because they check the real website's identity before they'll work. This is the single biggest upgrade, and it's built into the plans you already pay for.
• Shorter leashes on the token. Settings that re-check who and where you are, and expire the wristband sooner, shrink the window an attacker has. On Microsoft 365 this is Conditional Access, and most owners have it and have never turned it on.
• Knowing the right button. When something smells wrong, revoke sessions first, then reset the password. In that order. That one habit is the difference between a scare and a month.

How to check where you stand

Two questions tell you most of it. First, if your email were acting strange right now, would you know how to sign out every device at once - not just change the password? Second, has anyone ever looked at where your account is actually signed in from? Both systems keep that list, and a login from a country you've never visited is right there in it for anyone who thinks to look.

If the honest answer to either is no, that's not a failing. It's just the gap, and it's a quick one to close before it's a problem instead of after.

Common questions

If I have two-factor on, can my email still be hacked?

Yes. Two-factor stops someone using a stolen password, but attackers now steal the session token your browser gets after you log in. With that token they don't need your password or your code, because the system treats them as already signed in.

What is session token theft?

When you log in and pass two-factor, the system gives your browser a token so you don't have to re-authenticate on every action. If an attacker captures that token - usually through a fake login page that relays to the real one, or malware on a computer - they can use your account without logging in themselves.

I think my account was breached. Does changing my password fix it?

Not on its own. The attacker is likely using a stolen session token, not your password, so a reset doesn't remove them. You have to revoke active sessions - sign out everywhere - and then reset the password. Microsoft 365 and Google Workspace both have that control.

How do I actually prevent this?

Move to phishing-resistant sign-in like passkeys or hardware security keys, which won't authenticate to a fake page, and turn on the access controls that expire sessions and flag unusual logins. Both are included in common business plans and usually just need switching on.