We know just a little about hackers because it’s very unfortunate that we can’t know more unless we fall victims. There’s a chance, however, for you to know before hand that the trusted two-factor authentication (which is supposedly the strongest online security one can ever have) has become vulnerable to attacks.

Do not go to sleep believing that you have forever secured your accounts with the two-step verification method because hackers are watching, thinking and strategizing while you dream dreams.

The two-factor authentication as a security measure, requires a second level of proof of who you are before access is granted to your computer, phones or emails. This means that a code is sent to your phone each time you attempt logging into your account.

This method secures your account(s) and prevents anyone from gaining unauthorized access, even if they are smart enough to get hold of your password.

However, hackers and hijackers are managing to find ways around it.

Earlier this week, Alex MacCaw, cofounder data API company Clearbit, shared a screenshot of a text attempting to trick its way past two-factor authentication (2FA) on a Google account.

Here’s how it works:

The attacker sends the target a text message, pretending to be the very company that the target has an account with.

They say they have detected “suspicious” activity to the account, and so are sending the 2FA code to the target, which they should then text back to them to avoid having their account locked.

The victim, worried they are being hacked and not wanting to lose access to their data, sends the code back, believing they have thwarted the attempted hack.

But in doing so, they actually give the hacker the one thing they needed to break into the account.

The hacker enters the victim’s password, followed by this ill-gotten 2FA code, and they’re in.

The attacker can sometimes even spoof their identity – so the text looks like it comes from Google, or Facebook, or Apple, rather than an unknown number.

Of course, the attacker still needs the victim’s password for this to work. But there are a number of ways they could get hold of it. Often they look at data dumps from old hacks for emails/usernames and passwords which they then try on other sites, because so many people reuse passwords across multiple accounts and platforms.

Huge databases of tens of millions of email addresses and passwords have been floating around in the last few weeks – notably from LinkedIn and MySpace. So if you reuse passwords, your login details may have been shared online right now without you realizing.