Can someone get into my account even with two-step verification on?
Yes, though it's much harder. The main ways are stealing your session cookie with malware, tricking you into typing a code on a fake site, or flooding your phone with approval prompts until you tap Approve. Two-step still stops most attacks, so keep it on.
After you sign in, the website saves a session cookie in your browser, a small note that says "this browser already signed in". Info-stealers, malware often hidden in fake or pirated downloads, can copy that cookie along with saved passwords. Loaded into a thief's browser, it can skip both your password and your code, because that sign-in already happened.
Push fatigue, also called MFA fatigue, is when a criminal who knows your password keeps triggering approval prompts on your phone, hoping you'll give in. Never approve a sign-in you didn't start. Passkeys and security keys are the strongest choice, because they only work on the real site and there's no prompt someone far away can send you.
- Never approve a prompt or share a code you didn't ask for
- If prompts keep coming, change your password right away
- Check your account's devices list and sign out of all other sessions
- Run a malware scan, and change passwords from a device you trust if you suspect infection
- Switch to a passkey or authenticator app where you can
How secure is your computer overall? Take the 2-minute checkup →
Session Cookies and Staying Signed In
From the How Accounts Get Stolen course. Why a stolen session cookie can skip your password and two-step.