The weak link is often one password reused across mail, shopping, and corporate VPN. When one database leaks, attackers spray the same pair everywhere. Fix it with unique long passwords per site — ideally from a password manager (1Password, Bitwarden, or the browser vault for lower-risk accounts).
MFA on mail, remote access, and admin roles cuts damage after a password leak. Prefer TOTP apps or FIDO2/WebAuthn security keys over SMS where possible (SIM swap is a documented threat).
Example: forum breach and corporate VPN
An employee reuses a password on a hobby forum and the VPN. After the forum dumps hashes, attackers crack or spray the password against the company portal. MFA on VPN stops the chain; without it, domain compromise is a realistic next step.
Policy that helps
Require MFA for remote entry and roles touching customer data. Forced periodic password rotation without cause often yields “password1”, “password2” — better to react to real incidents, monitor domain breaches, and replace shared accounts with service principals where possible.
Phone biometrics are convenience; you still need backup codes in a safe place and a tested account recovery path if the device is lost.
When someone asks for “the code from your text”
No bank or service should ask you to relay a one-time code to another person by phone or chat. A common scam: the attacker triggered a password reset on your account and needs the OTP you just received — or they pose as a relative in distress. Rule: never share SMS/app codes with anyone. See family impersonation and smishing.