Your business uses two-factor authentication (2FA). Staff enter a password, then a code or approval from their phone. That is an important defence — but it does not make an account immune to compromise.
An attacker may trick someone into handing over a valid code, or steal the digital session created after a successful sign-in. For a professional services business, a compromised mailbox can expose client correspondence and create an opportunity for convincing payment fraud.
Understanding the difference helps you choose the right protection: stronger authentication to reduce the chance of a break-in, supported by monitoring and response when suspicious activity appears.
A 2FA code and a session token are different
- A 2FA code proves a sign-in attempt. A one-time code from an authenticator app or text message is valid only briefly. If a criminal captures and submits it before it expires or is consumed, it may complete the criminal’s sign-in.
- A session token keeps you signed in. After authentication, a service may issue a session cookie or other token so you do not need to log in for every page. Some stolen tokens can be replayed to impersonate you without another 2FA challenge, subject to expiry and the service’s security controls.
Think of a code as a check at reception and a session token as the temporary access pass issued afterwards. Protecting the reception desk matters, but so does noticing when someone else is using the pass.
How criminals steal codes and sessions
Real-time phishing. An email claims that a document, invoice or shared file needs your attention. Its link leads to a convincing sign-in page. The page captures your password and one-time code and passes them to the real service while they are still usable. An authenticator app’s changing code can still be phished this way.
Adversary-in-the-middle phishing. A malicious site sits between you and the genuine service, relaying the sign-in process. You may complete a real MFA challenge, while the attacker captures the resulting session cookie. The attacker then attempts to reuse that authenticated session.
Microsoft documented this pattern leading to mailbox access and business email compromise in its investigation, From cookie theft to BEC.
Malware and untrusted browser extensions. A compromised device can expose browser session data or allow an attacker to act through an already signed-in browser. This is why protecting the computer remains essential, even when sign-in uses strong authentication.
Social engineering and phone-number takeover. A criminal posing as support may ask you to read out a code or approve a prompt. Repeated push requests can pressure someone into approving a sign-in they did not initiate. A SIM-swap can redirect SMS codes to an attacker. These are different routes to account access; they do not all involve stealing a browser token.
What happens after an account takeover?
Consider an illustrative example: an accounts employee opens a fake shared invoice and completes a sign-in. The attacker gains access to the mailbox, follows an existing payment conversation and sends altered bank details from the employee’s real account.
The attacker may also create forwarding or inbox rules, seek sensitive documents, or add another way to regain access. A familiar sender address is therefore not enough to trust a payment instruction. Confirm changed bank details by calling a known contact on a number you already hold.
How IN2Tech’s Blackpoint Cyber MDR helps
IN2Tech offers managed detection and response (MDR) powered by Blackpoint Cyber. It combines security technology with a security operations centre (SOC) that investigates and responds around the clock.
Cloud identity monitoring. With the appropriate cloud service connected, Blackpoint monitors supported account activity for signs of compromise. Its published cloud capabilities include suspicious-login and mailbox-rule monitoring, with analysts able to disable compromised identities.
See Blackpoint’s description of Cloud MDR and its active response capabilities.
Country and VPN restrictions for Office 365. IN2Tech’s Blackpoint integration with Microsoft 365 (Office 365) can block sign-ins from unapproved countries and detected commercial VPN services, according to the configured policy. This adds another barrier when stolen credentials or tokens are used from prohibited locations or VPN infrastructure. Legitimate staff travel and approved access need to be accounted for when setting these rules.
These controls work alongside behavioural monitoring. An attacker may use an allowed-country IP address or a residential proxy, so location and VPN restrictions alone cannot establish that a sign-in is safe.
Blackpoint also documents identity detections for anomalous tokens, attacker-in-the-middle activity and suspicious browser sign-ins. These signals help identify abuse even when an attacker appears to have authenticated successfully.
These capabilities are described in Blackpoint’s September 2026 identity protection update.
Endpoint monitoring. The complementary endpoint service watches enrolled computers for suspicious behaviour and gives responders a way to contain affected devices. This matters where the original theft involved a compromised computer.
IN2Tech coordination. We help deploy the service, review the configured coverage and coordinate remediation with the Blackpoint SOC. Together, the cloud and endpoint layers help reduce the time an attacker has to operate.
Coverage depends on the subscribed services, supported integrations, enrolled devices and configured permissions. Endpoint protection alone does not provide cloud account monitoring. MDR reduces risk and supports containment; it cannot guarantee that every attack will be prevented or that no data will be accessed.
What your business should do now
- Move to phishing-resistant MFA. Prioritise FIDO2/passkeys or security keys and Windows Hello for Business where supported. These methods bind authentication to the legitimate service, helping resist fake sign-in sites. Start with administrators, finance staff and other high-impact accounts.
- Enforce the stronger method. Registering a security key is only part of the job. Review authentication policies and recovery routes so a weaker fallback does not undermine the intended protection. Number matching can reduce accidental push approvals, but it is not phishing-resistant MFA.
- Review access policies. Use Conditional Access to restrict sensitive access to appropriate users and managed devices. Apply risk and token-protection controls where supported. Licensing, application compatibility and careful rollout matter.
- Protect the browser and device. Keep operating systems and browsers updated, control extensions and software installation, and maintain endpoint protection. Phishing-resistant sign-in does not make an infected device safe.
- Make reporting easy. Never give a code to someone claiming to be support. Reject unexpected prompts and report them immediately. Open business services through trusted bookmarks rather than unexpected email links.
- Confirm cloud monitoring is enabled. Ask which tenants and accounts are covered, what responders can do, and who coordinates recovery outside business hours.
Microsoft explains which methods qualify and how to require them using Conditional Access authentication strengths.
Suspect a stolen code or token? Act immediately
Contact IN2Tech through your established support channel. If the affected mailbox may be compromised, use another trusted way to reach us. Record what happened, including the message, link and approximate time; avoid interacting with the suspicious page again.
Your IT response team should contain the account, revoke sign-in sessions and relevant tokens, reset credentials from a trusted device, and inspect authentication methods, application permissions and mailbox rules. If a device may be infected, it also needs investigation and containment.
A password reset alone is not a complete response. Revocation behaviour varies by token and application. Some application sessions require separate action, and changes may take time to take effect. Responders need to verify containment and investigate what was accessed.
Microsoft sets out these limitations in its guidance on revoking user access in an emergency.
Add a response plan to your sign-in protection
Keep 2FA enabled and strengthen it where possible. Then make sure someone is watching for the activity that can follow a stolen identity — at night, on weekends and during holidays.
IN2Tech can review your authentication setup and explain how Blackpoint Cyber endpoint and cloud MDR fit your business. We will identify the coverage you need and the practical steps to improve it.
To discuss your protection, contact IN2Tech.
For more on our existing service, read why 24/7 managed detection and response matters.