How accounts really get hacked: a calm threat model

Most account takeovers are not the work of a movie-style genius. They rely on a handful of ordinary tricks that work again and again. Once you know the main routes in, you can close them calmly, one at a time.

Watch the 1-minute overview

Watch the full video guide for this module

Think like a defender: your personal threat model

• Security professionals use a 'threat model': a short, honest answer to five questions. What do I have that is worth protecting? Who might want it? How would they most likely get in? What would happen if they did? What will I do about it?
• For most teenagers the valuable things are your email, your phone number, social and gaming accounts, photos, any bank or payment app, and your UAE Pass or school login.
• The likely attackers are usually not people who know you. They are criminals working at scale, trying the same tricks on thousands of accounts at once.
• The UAE Cyber Security Council said in September 2025 that more than 1.4 billion accounts are hacked globally each month, and stressed that every user is responsible for limiting their digital trace (WAM).
• The aim is not fear. It is to spend your effort where it actually reduces risk: your email first, then your phone number, then everything else.

Route 1: reused passwords and 'credential stuffing'

• When a website is breached, lists of email addresses and passwords end up being traded by criminals.
• OWASP, a respected web security community, describes credential stuffing as the automated injection of stolen username and password pairs into the login forms of other websites.
• It works because many people reuse the same email and password. OWASP cites an analysis of two breached sites where two-thirds of the users found in both had used the same password on each.
• The NCSC warns that with reused passwords, criminals 'only need one password to access all your accounts'.
• The fix is simple: a different password for every important account, starting with your email (lesson cy-02).

Route 2: phishing and fake login pages

• Phishing tricks you into typing your password or code into a fake page, or into installing something harmful. The Scams and Fraud module covers the money side in detail.
• CISA lists these signs: urgent or emotional language, requests for personal or financial information, untrusted shortened links, and addresses that are almost right, such as 'amazan.com'.
• CISA also notes that poor grammar is no longer a reliable sign, because AI tools can now write flawless messages.
• Fake login pages often look perfect. The safest habit is to never sign in from a link in a message: open the app or type the address yourself.

Route 3: data breaches you never caused

• Your details can leak when a company you use is breached, even if you did nothing wrong.
• The NCSC warns that scam messages may arrive 'some time after the breach is made public', using the leaked details to sound convincing.
• If a suspicious message quotes a password you still use, change it everywhere you used it (NCSC).
• The NCSC suggests checking whether your email appears in known breaches using a tool such as haveibeenpwned, or a similar check built into a password manager or antivirus.

Route 4: your phone number and 2SV tricks

• SIM swapping means a criminal persuades a mobile provider to move your number to their SIM, so your text message codes go to them. The FTC warns that they can then change your passwords and lock you out (BleepingComputer, 2019).
• The FTC's advice: set up a PIN or password on your mobile account if your provider offers one, and for sensitive accounts use an authenticator app or security key, because text message verification may not stop a SIM swap.
• Push bombing (also called MFA fatigue) means flooding you with login approval requests until you tap 'approve' to make them stop. CISA lists it among the main ways criminals get past 2SV (Infosecurity Magazine).
• Rule of thumb: never approve a login request you did not start yourself, however many times it pops up.

Route 5: harmful and unofficial apps

• The UAE Cybersecurity Council has warned that downloading apps from unauthorised sources may lead to surveillance, data theft or unauthorised access to personal files, including photos and conversations (Gulf News, 2025).
• Its advice is to install apps only from official app stores and to review app permissions (lesson cy-05 goes further).
• Be wary of 'modded' games, free versions of paid apps and anything a stranger sends you to install. These are classic ways to slip harmful software onto a device.