--- title: "Password and MFA Habits That Actually Hold Up | StartCloud" description: "Module 3 of our free Cyber Hygiene for Staff pathway: how passwords really get stolen, why passphrases and a password manager fix it, and the MFA tricks scammers use once everyone has it." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, { "@context": "https://schema.org", "@type": "LearningResource", "name": "Password and MFA Habits That Actually Hold Up", "description": "Module 3 of the Cyber Hygiene for Staff pathway: how passwords really get stolen, why passphrases and a password manager fix it, what MFA does, and the tricks scammers use to get around it.", "educationalLevel": "Beginner", "learningResourceType": "Module", "isPartOf": { "@type": "Course", "name": "Cyber Hygiene for Staff", "url": "https://startcloud.au/learn/cyber-hygiene-for-staff", "provider": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" } }, "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "datePublished": "2026-07-24", "dateModified": "2026-07-24", "url": "https://startcloud.au/learn/password-and-mfa-habits" } ] --- [![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth")](/ "StartCloud | Managed IT Services Perth") - Cybersecurity - AI Solutions - Cloud - Technology - Networking - Explore [Contact Us](/contact "Contact StartCloud, Perth IT Support") Open menu Module 3 of StartCloud's Cyber Hygiene for Staff learning pathway, in six short units with a knowledge check: how passwords leak from breached websites and get reused against you, why passphrases beat complex passwords, how a password manager makes unique passwords realistic, what MFA is and why authenticator apps beat SMS, and the MFA fatigue and fake verification tricks scammers use. Course contents [Pathway overview](/learn/cyber-hygiene-for-staff) Pathway Cyber Hygiene for Staff 0 of 6 units done in this module 1. [Why you're a target ](/learn/why-cyber-criminals-target-your-business) 2. [Spot the phish ](/learn/how-to-spot-phishing-emails) 3. Passwords and MFA 1. How passwords actually get stolen 2 min 2. Passphrases beat P@ssw0rd! 2 min 3. Let a password manager do the remembering 1 min 4. MFA, the seatbelt for your accounts 2 min 5. The tricks scammers use once you have MFA 1 min 6. Knowledge check 2 min 4. [Devices and Wi-Fi ](/learn/safe-devices-and-wifi-habits) 5. [Share safely ](/learn/share-work-files-safely) 6. [When something looks off ](/learn/what-to-do-cyber-incident) 7. [Scams aimed at you ](/learn/scams-that-target-you-personally) 8. [Working from home ](/learn/working-from-home-safely) 9. [Social engineering ](/learn/social-engineering-tactics) # Password and MFA Habits That Actually Hold Up Module 3 · Passwords Unit 1 of 6 · about 2 min ## How passwords actually get stolen Let us clear something up first. Nobody is guessing your dog's name, your footy team, or your birthday. Real password theft is boring, industrial, and it almost never starts with you. It starts with **someone else's website getting breached**. Passwords leak in bulk, millions at a time, and then criminals run a trick called **credential stuffing**: take every leaked email-password combo and try it on every other site that matters. It works for one reason only. People reuse passwords. A website you used years ago gets breached That pizza shop loyalty site, the forum from 2018, the online store you ordered from once. Their whole customer database, emails and passwords included, ends up for sale. Your email and password land in a combo list Criminals bundle millions of leaked email-password pairs into lists and trade them. Yours is probably in a few already. That is not an insult, it is just the internet. Bots try that exact combo everywhere Automated tools fire your old pizza-shop password at banks, email providers and Microsoft 365 sign-in pages, thousands of accounts a minute. If you reused it at work, they are in. That is the whole scam. One reused password quietly connects a forgotten loyalty account to your work email, and the attacker never had to be clever. The fix, as we are about to see, is not remembering harder. It is making reuse impossible. Want to see your own damage report? Visit [haveibeenpwned.com](https://haveibeenpwned.com) and type in your email address. It is a free, widely trusted service that tells you which known breaches your address has appeared in. Most people find a few. If a password you still use anywhere shows up, change it today, starting with anything work related. Mark done and continue ![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth") Cybersecurity-led IT for Australian businesses. We manage security, compliance, and modern IT environments, so risk is governed, not guessed. Ground Floor West, 6 Gibberd Road, Balcatta WA 6021 [08 6285 0001](tel:+61862850001 "Call StartCloud on 08 6285 0001") Serving Perth businesses from Balcatta, Western Australia. ![Microsoft Solutions Partner - Modern Work](/assets/microsoft-solutions-partner-DqvNMv91.png "Microsoft Solutions Partner: Modern Work") ### Services - [Cybersecurity](/cybersecurity "Cybersecurity Services Perth | StartCloud") - [AI Solutions](/ai "AI & Automation Services Perth | StartCloud") - [Cloud](/cloud "Cloud Services Perth | StartCloud") - [Technology](/technology "IT Services and Support | StartCloud") - [Networking](/networking "Business Networking Perth | StartCloud") - [Packages](/packages "IT Support Packages Perth | StartCloud") ### Company - [About](/about "About StartCloud, Perth IT Support Team") - [Company Facts](/facts "StartCloud Company Facts | Perth Cybersecurity-First AI MSP") - [Resources](/resources "IT Resources & Guides | StartCloud Perth") - [Service Areas](/it-support-perth "IT Support Perth | StartCloud") - [Contact](/contact "Contact StartCloud, Perth IT Support") ### Locations - [All Service Areas](/locations "Perth IT Support Areas | StartCloud") - [IT Support Perth](/it-support-perth "IT Support Perth | StartCloud") - [Cybersecurity Perth](/cybersecurity-perth "Cybersecurity Perth | StartCloud") - [MSP Perth](/managed-service-provider-perth "Managed Service Provider Perth | StartCloud") - [Industries We Serve](/industries "IT Support by Industry Perth | StartCloud") © 2026 Start Technologies Pty Ltd trading as StartCloud. All rights reserved. ABN 17 676 121 449 [](https://www.linkedin.com/company/startcloudau "StartCloud on LinkedIn")[](https://www.facebook.com/startcloudaus/ "StartCloud on Facebook")[](https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj "StartCloud on Google") [Terms of Service](/terms-of-service "Terms of Service | StartCloud")| [Privacy Policy](/privacy-policy "Privacy Policy | StartCloud")| [Modern Slavery Policy](/modern-slavery-policy "Modern Slavery Policy | StartCloud")| [Cookie Policy](/cookie-policy "Cookie Policy | StartCloud") StartCloud Assistant Online G'day! 👋 I'm the StartCloud Assistant. How can I help you today? Tell me about your servicesBook a discovery callI need IT support Find Your Solution