SAMTypes the code
on the fake page
PART 4
PHISHING · The password is not enough01 / 9
CONTINUING THE MFA STORY
I have the password.
But I am still locked out.
Imagine I am the phisher. I enter Sam's leaked password on the real website. The account asks me for an MFA code.
Can I log in with only the password?
P
PHISHER'S VIEWI know the password
REAL ACCOUNTSecure sign-in
ACCESS BLOCKED
The code is on Sam's phone. I do not have it.
REAL WORLDFishing
VSCYBERSECURITYPhishing
BAITFAKE EMAIL308 227482 193731 640THE PHISHER NEEDS THE SECOND CHECK
So I send Sam
a fake warning.
A phisher sends a fake message to steal information. This message uses fear and urgency: “Your account is under attack.”
What does the phisher want Sam to do?
!
FROMAccount Safetyalerts@account-check.example
URGENT: Someone has your password
Your account is under attack.
It will be disabled in 5 minutes. Verify your identity now to keep your files.
PROTECT MY ACCOUNT
account-check.example/verifySAM DID NOT START THIS LOGIN OR ASK FOR THIS MESSAGE.
FEAR IS NOT THE ONLY BAIT
A free game console?
The prize is the trap.
The phisher can also use excitement. Sam is told he was selected to win a new game console. The fake claim page asks for the code that just arrived on his phone.
Why would a prize need Sam's login code?
✦●✦
YOU
WIN!
WIN!
FROM: GameZone Rewards <winner@game-gift.example>CONGRATULATIONS — YOU WERE SELECTED!
A brand-new game console is waiting for you. Claim it in the next 10 minutes.
CLAIM MY FREE CONSOLE
↓
FAKE CLAIM PAGE
Enter the six-digit code sent to your phoneWe need it to confirm your prize.
482 193CLAIM NOW
FREE PRIZE + HURRY + MFA CODE= a phishing trap
THE LINK IS THE TRAP
The fake page asks
for Sam's real code.
The page copies familiar colours and words. It looks real, but the phisher controls it.
Who receives the code when Sam presses “Verify”?
account-check.example/verify
FAKE PAGE
!
Protect your account
Enter the six-digit security code we sent to your phone.
482 193
VERIFY MY ACCOUNT
The code is real.The page is fake.
THE CODE WORKS ONLY FOR A SHORT TIME
Now the phisher
has both checks.
The phisher quickly enters Sam's code on the real website. The one-time code completes that login.
What information moved from Sam to the phisher?
PHISHERSees the code
482 193
REAL WEBSITEChecks the code
Password + code
ACCOUNTLogin complete
Access granted
MFA was still working. The fake page tricked Sam into handing over the second check.
WHAT MADE THE ATTACK WORK?
The phisher collected
the full login.
The password was the first check. The MFA code was the second check.
Which moment completed the attack?
1
FIRST CHECKPasswordAlready leaked
✓+
2
SECOND CHECKMFA codeEntered on the fake page
✓=
OPENFull login
Keep the second check private.Only enter a code when you started the login yourself in the official app or website.
CHECK BEFORE YOU CLICK
Four checks.
Top to bottom.
Check the sender, link, pressure and code before you act.
SENDER
Check the full email address.
accounts@google.comVSaccounts@goog1e.comLINK
Check where the link really goes.
forms.google.comVSgoogle.forms.example.comRUSHING
Urgent messages can make you panic.
“Act now! Your account closes in 5 minutes.”
Why are they rushing me? Stop, breathe and think.CODE
Check what the code is for.
LOGIN CODERESET CODEBREAK THE CHAIN
Stop the attack
before the code is shared.
MFA still gives strong protection when the second check stays private.
STOP
Do not click the link, enter a code or approve a login you did not start.
CHECK
Open the official app or type the known website yourself.
TELL
Show a trusted adult, teacher or school IT.
An unexpected code is a warning.Someone may be trying to sign in with your password.
Already entered it?Close the page and tell a trusted adult or school IT immediately. Change the password through the official website.