How MFA protects an account when the password is stolen

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A thief steals Mia's password and tries to log in to her account that has MFA turned on. What happens after the thief types the password?

A The site asks for the second factor, like a code from Mia's phone

B The thief is logged straight in because the password was right

2. Why can't an attacker with only a stolen password get into an account that uses a phone code?

A They don't have the phone that receives the code

B The password stops working once it is stolen

3. Which login is the attacker most likely to complete?

A An account with a password plus a code sent to the owner's phone

B An account with only a password and no MFA

4. Liam uses the same password on a game site and his email. The game site has a data breach, but his email has MFA on. What is true?

A MFA is useless, because the attacker already knows the password

B MFA still blocks the attacker, who has the password but not Liam's second factor

5. An attacker tries a stolen password and is asked for a security key. The key is in Zoe's school bag. What happens?

A The attacker is locked out because they don't have the key

B The attacker can skip the key because they know the password

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Step 1: password OK, Step 2: code needed		Apassword stolen + MFA off = login allowed
2attacker has password, no phone		Bpassword stolen + MFA on = login blocked
3Mia re-used her password on a shady site that was hacked. Her account still stays safe because MFA is on.		CThe second factor is a separate proof, like a code on your phone or a security key. Knowing the password does not give the thief that item.
4Without MFA, a thief with a stolen password can log straight in.		DMFA is a backup layer, not a reason to re-use passwords. A re-used password can still be stolen, and MFA can sometimes be bypassed or lost, so each account still needs its own strong password.
5MFA is on, so I can re-use one password everywhere.		EA login with MFA asks for a second proof after the password, so a stolen password alone does not get the attacker in.
6A thief has my password, so they can pass the second factor too.		FThe attacker cannot get the one-time code or approval, so the login is blocked and the account stays safe.

Definitions

second factor

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF passwordOK ___ codeOK THEN DISPLAY "Access granted" ENDIF

passwordOK ← TRUE phoneOK ← _____ loginOK ← passwordOK AND phoneOK

IF passwordOK THEN REQUEST ____________ ENDIF

reusedPW ← TRUE codeKnown ← FALSE attackerIn ← reusedPW AND _________

IF passwordOK AND codeOK THEN login ____ DISPLAY "Login blocked" ENDIF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF password is correct THEN

B ask for the phone code

C IF code is wrong THEN

D allow login

E ELSE deny login

Question 2

A enter username

B enter stolen phone code

C system asks for phone code

D attacker has no phone

E login is denied

Question 3

A IF pass OR code THEN

B allow login

C ELSE deny login

Question 4

A reuse: same password on A, B

B site A is breached

C attacker logs straight into B

D MFA asks for a phone code

E attacker has no code: denied

Question 5

A has_pass ← TRUE

B has_key ← FALSE

C login ← has_pass

D PRINT login

Answer Key

How MFA protects an account when the password is stolen

Section A: Quick Questions

A — The site asks for the second factor, like a code from Mia's phone

A — They don't have the phone that receives the code

B — An account with only a password and no MFA

B — MFA still blocks the attacker, who has the password but not Liam's second factor

A — The attacker is locked out because they don't have the key

Section B: Match the Pairs

Step 1: password OK, Step 2: code needed → A login with MFA asks for a second proof after the password, so a stolen password alone does not get the attacker in.

attacker has password, no phone → The attacker cannot get the one-time code or approval, so the login is blocked and the account stays safe.

Mia re-used her password on a shady site that was hacked. Her account still stays safe because MFA is on. → password stolen + MFA on = login blocked

Without MFA, a thief with a stolen password can log straight in. → password stolen + MFA off = login allowed

MFA is on, so I can re-use one password everywhere. → MFA is a backup layer, not a reason to re-use passwords. A re-used password can still be stolen, and MFA can sometimes be bypassed or lost, so each account still needs its own strong password.

A thief has my password, so they can pass the second factor too. → The second factor is a separate proof, like a code on your phone or a security key. Knowing the password does not give the thief that item.

Section C: Definitions

second factor — An extra proof of identity, like a code from your phone, needed after the password. A thief with only your stolen password can't log in without it.

Section D: Fill in the Blanks

IF passwordOK AND codeOK THEN
  DISPLAY "Access granted"
ENDIF

passwordOK ← TRUE
phoneOK ← FALSE
loginOK ← passwordOK AND phoneOK

IF passwordOK THEN
  REQUEST secondFactor
ENDIF

reusedPW ← TRUE
codeKnown ← FALSE
attackerIn ← reusedPW AND codeKnown

IF passwordOK AND codeOK THEN login
ELSE DISPLAY "Login blocked"
ENDIF

Section E: Spot the Error

C — Login should only be allowed when the second factor code is correct. Allowing it when the code is wrong would let a thief in. It should be IF code is correct THEN.

B — The attacker only has the stolen password, not the phone, so they cannot enter a phone code. Line 2 should be enter stolen password.

A — MFA needs BOTH the password AND the second factor. With OR, a stolen password alone would be enough. It should be IF pass AND code THEN.

C — Even with a re-used password, MFA on site B still asks for a code. The attacker cannot log straight in. Line 3 should be attacker tries it on site B.

C — This ignores the security key, so the stolen password alone would give access. Login needs both: login ← has_pass AND has_key.