← Years 7–8 Digital Systems

How MFA protects an account when the password is stolen

An extra proof of identity, like a code from your phone, needed after the password. A thief with only your stolen password can't log in without it.

Part of: 7-8 Digital Technologies Vic Curric - Digital Systems and Security — Module 60, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 30, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 55, IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 30, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 40

Understanding How MFA protects an account when the password is stolen in Years 7–8 Digital Systems

What it does: Re-using a password is risky, but MFA adds a second barrier. The thief has the password but cannot pass the second step. With only one factor, the password is the only barrier. Once it is stolen, nothing else stops the attacker. An unexpected code means someone has probably got your password. Never share a code, because it is the second factor that is protecting you. The fix is to use MFA and a unique password for every account, so two layers protect you.

Common mistakes: Login should only be allowed when the second factor code is correct. Allowing it when the code is wrong would let a thief in. It should be IF code is correct THEN. The attacker only has the stolen password, not the phone, so they cannot enter a phone code. Line 2 should be enter stolen password.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add How MFA protects an account when the password is stolen to a class →

This module's key terms are also in a printable crossword (Modules 26–74) and word search (Modules 4–74).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A thief steals Mia's password and tries to log in to her account that has MFA turned on. What happens after the thief types the password?
The thief is logged straight in because the password was rightThe site asks for the second factor, like a code from Mia's phone
Matches
MFA is on, so I can re-use one password everywhere.
↓
MFA is a backup layer, not a reason to re-use passwords. A re-used password can still be stolen, and MFA can sometimes be bypassed or lost, so each account still needs its own strong password.
Applying
Meanings
Term
second factor
Meaning
An extra proof of identity, like a code from your phone, needed after the password. A thief with only your stolen password can't log in without it.
Practice
SET password_ok TO true
Testing
Gaps
IF passwordOK codeOK THEN
Check Answer
Spots
2 ask for the phone code
3 IF code is wrong THEN

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Hedgehog' badge — First Steps, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A thief steals Mia's password and tries to log in to her account that has MFA turned on. What happens after the thief types the password?
A. The site asks for the second factor, like a code from Mia's phone ✓
B. The thief is logged straight in because the password was right
With MFA on, the password is only step one. The site still asks for the second factor, which the thief does not have.
2. Why can't an attacker with only a stolen password get into an account that uses a phone code?
A. They don't have the phone that receives the code ✓
B. The password stops working once it is stolen
The stolen password is still correct, but the attacker lacks the phone, so they cannot give the second factor.
3. Which login is the attacker most likely to complete?
A. An account with a password plus a code sent to the owner's phone
B. An account with only a password and no MFA ✓
With no second factor, the stolen password is all the attacker needs. With MFA, they are stopped at step two.
4. Liam uses the same password on a game site and his email. The game site has a data breach, but his email has MFA on. What is true?
A. MFA is useless, because the attacker already knows the password
B. MFA still blocks the attacker, who has the password but not Liam's second factor ✓
Re-using a password is risky, but MFA gives a second layer of protection. It is still best to use a different password for each account.
5. An attacker tries a stolen password and is asked for a security key. The key is in Zoe's school bag. What happens?
A. The attacker is locked out because they don't have the key ✓
B. The attacker can skip the key because they know the password
A security key is something you have. The attacker can't complete the login without it, even with the right password.

Match the Pairs

Step 1: password OK, Step 2: code needed → A login with MFA asks for a second proof after the password, so a stolen password alone does not get the attacker in.
attacker has password, no phone → The attacker cannot get the one-time code or approval, so the login is blocked and the account stays safe.
Mia re-used her password on a shady site that was hacked. Her account still stays safe because MFA is on. → password stolen + MFA on = login blocked
Without MFA, a thief with a stolen password can log straight in. → password stolen + MFA off = login allowed
MFA is on, so I can re-use one password everywhere. → MFA is a backup layer, not a reason to re-use passwords. A re-used password can still be stolen, and MFA can sometimes be bypassed or lost, so each account still needs its own strong password.
A thief has my password, so they can pass the second factor too. → The second factor is a separate proof, like a code on your phone or a security key. Knowing the password does not give the thief that item.

Key Term

second factor
An extra proof of identity, like a code from your phone, needed after the password. A thief with only your stolen password can't log in without it.

Fill in the Blanks

1. IF passwordOK AND codeOK THEN DISPLAY "Access granted" ENDIF
Hint: Type the logic operator that needs both the password check and the code check to be true.
2. passwordOK ← TRUE phoneOK ← FALSE loginOK ← passwordOK AND phoneOK
Hint: Type the Boolean value that shows the attacker does not have the phone.
3. IF passwordOK THEN REQUEST secondFactor ENDIF
Hint: Type the name of the extra proof the system asks for after the password.
4. reusedPW ← TRUE codeKnown ← FALSE attackerIn ← reusedPW AND codeKnown
Hint: Type the variable that shows whether the attacker knows the extra code.
5. IF passwordOK AND codeOK THEN login ELSE DISPLAY "Login blocked" ENDIF
Hint: Type the keyword for the branch that runs when the second factor check fails.

Spot the Error

Question 1
A IF password is correct THEN
B ask for the phone code
C IF code is wrong THEN
D allow login
E ELSE deny login
Line C — Login should only be allowed when the second factor code is correct. Allowing it when the code is wrong would let a thief in. It should be IF code is correct THEN.
Question 2
A enter username
B enter stolen phone code
C system asks for phone code
D attacker has no phone
E login is denied
Line B — The attacker only has the stolen password, not the phone, so they cannot enter a phone code. Line 2 should be enter stolen password.
Question 3
A IF pass OR code THEN
B allow login
C ELSE deny login
Line A — MFA needs BOTH the password AND the second factor. With OR, a stolen password alone would be enough. It should be IF pass AND code THEN.
Question 4
A reuse: same password on A, B
B site A is breached
C attacker logs straight into B
D MFA asks for a phone code
E attacker has no code: denied
Line C — Even with a re-used password, MFA on site B still asks for a code. The attacker cannot log straight in. Line 3 should be attacker tries it on site B.
Question 5
A has_pass ← TRUE
B has_key ← FALSE
C login ← has_pass
D PRINT login
Line C — This ignores the security key, so the stolen password alone would give access. Login needs both: login ← has_pass AND has_key.

Student with a class code? Join your class →