Why MFA Still Matters Even When Your Password Is Already Stolen

It sounds like a contradiction: if your password is already in a leaked database, what good is a second login step? Plenty, as it turns out. Multi-factor authentication (MFA) is designed for exactly this situation — the moment your password is no longer secret. After the June 2026 leak of roughly 24 billion credentials, understanding why MFA still works, and which kind to use, is one of the most useful things a beginner can learn.

The thing MFA is actually for

A password is "something you know." MFA adds a second proof — usually "something you have" (your phone, a security key) or "something you are" (a fingerprint). The whole point is redundancy: even if the first factor is compromised, the second one stops the login.

So the case for MFA gets stronger, not weaker, once a password leaks. A leaked password without MFA is an open door. A leaked password with MFA is a key that no longer fits the lock, because the attacker is missing the second factor.

Why it matters specifically after a leak

When billions of email + password pairs circulate — as in the Cybernews-reported exposure of an open Elasticsearch database — attackers run them through automated credential-stuffing bots against thousands of sites. Those bots have the password. What they almost never have is your second factor.

The numbers back this up. Microsoft has reported that MFA blocks more than 99.9% of automated account-compromise attempts. As security vendor Descope explains, because a bot cannot supply a one-time code or approve a prompt on your phone, MFA defeats credential stuffing even when the attacker has the correct password. That is the entire reason MFA belongs at the top of your post-leak checklist. We cover the basics of the different types in a companion explainer.

Read: What is multi-factor authentication and which type is safest?

Not all MFA is equal — the honest hierarchy

Here is the nuance most articles skip. MFA stops the bulk attack (password-only bots) extremely well, but the targeted attack — a real-time phishing site that relays your code as you type it — can defeat the weaker forms. So choose your factor with that in mind:

The reason passkeys and FIDO2 security keys sit at the top is origin binding: the credential is mathematically tied to the genuine website's address, so it simply will not work on a look-alike phishing domain. Industry reporting notes that organizations like Google moved 85,000+ employees to security keys and reported zero successful phishing afterward. SMS and even app codes can, in principle, be relayed by a convincing fake site; a passkey cannot.

The practical takeaway for a beginner: any MFA is a huge upgrade over none, and where a site offers passkeys, prefer them.

The one gap to know about: stolen session tokens

MFA is not magic, and pretending it is would be dishonest. Its known weak spot is the stolen session token. After you log in and pass MFA, the site issues a cookie proving you are already authenticated. Infostealer malware can copy that cookie and let an attacker resume your session without re-passing MFA. This is exactly why the recent leak — built largely from infostealer logs — is dangerous despite widespread MFA.

The defense for that gap is not "skip MFA." It is to keep your devices clean of malware and to sign out of all sessions ("log out everywhere") when you suspect exposure, which invalidates stolen tokens. MFA plus clean devices plus session hygiene covers both the common attack and the sneaky one.

Don't forget backup codes

A common reason people avoid MFA is fear of being locked out if they lose their phone. The fix is backup codes: when you enable MFA, the service gives you a set of one-time recovery codes. Save them somewhere safe and offline — printed, or in your password manager's secure notes. With backup codes (or a second registered key), losing your phone is an inconvenience, not a lockout.

A short, practical plan

1. Turn on MFA on email, banking, your Apple/Google account, cloud storage, and social — the accounts that unlock the most.
2. Prefer passkeys or a security key where offered; otherwise an authenticator app; use SMS only if it is the sole option.
3. Save backup codes offline so you can never be locked out.
4. Keep devices malware-free and sign out of old sessions to close the session-token gap.

Frequently asked questions

If my password is already stolen, isn't it too late for MFA? No — that is precisely when MFA earns its keep. The attacker has the password but not your second factor, so the login still fails. Microsoft reports MFA blocks over 99.9% of automated attempts.

Is SMS-based MFA worthless? No. SMS stops the overwhelming majority of automated attacks; it is just weaker against targeted phishing and SIM-swap fraud. If SMS is your only option, use it — but upgrade to an app or passkey when you can.

What makes passkeys "phishing-resistant"? They are cryptographically bound to the real site's domain, so they will not authenticate on a fake look-alike page. There is no code for a phishing proxy to steal.

What if I lose my phone? Use the backup codes you saved when enabling MFA, or a second registered device or security key, to regain access — then re-enroll a new device.

Bottom line

A stolen password is a problem MFA was built to contain. It blocks the automated, password-only attacks that follow every big leak — over 99.9% of them, per Microsoft — and the phishing-resistant forms (passkeys, security keys) close the targeted-attack gap too. Its one blind spot, stolen session tokens, is handled by clean devices and signing out of old sessions. So even when your password is already out there, MFA is exactly the wall you want standing.

Sources and further reading