The scary story is the hacker. The common story is simpler: a new phone, an old email address nobody checks, a two-factor app that didn't transfer, and an account that is technically yours and practically gone. Here's how to make sure that's never you.
Turn on two-step login
Password alone isn't enough. Passwords leak from other sites constantly, and most people reuse them.
On POINT: Settings → Account → Two-step login. Scan the code with an authenticator app (Google Authenticator, Authy, 1Password, Apple's built-in Passwords app all work), enter the six-digit code, and it's on. From then on, logging in on a new device asks for the code.
We use authenticator apps rather than text messages for this because phone numbers can be stolen by convincing a carrier to move your number, and because codes by text cost money that we'd rather not have to recover from members.
Save the recovery codes
This is the step people skip, and it's the one that matters.
When you turn on two-step login, POINT shows a set of recovery codes. Each one works once, in place of the authenticator, if your phone is lost, broken or wiped. Save them somewhere that is not the phone: a password manager, a note in a safe, a printed sheet in the drawer with your passport.
If you lose your phone and you have the codes, you're in. If you lose your phone and you don't, you're relying on still having access to your email, and that's it.
Keep your email alive
Password reset goes to your email. If the email on your account is one you've stopped checking, change it now in Settings. If that email is tied to a phone number you no longer have for its own two-factor, fix that first. Your email is the root of every account you own.
Check your sessions
Settings → Account → Two-step login also lists the devices currently logged in to your POINT account, with device type and last activity. If something's there you don't recognize, sign it out and change your password. A new-device login sends you an email the moment it happens, so you'll usually know before you look.
Use a password manager
The honest advice everyone gives and few take. One strong, unique password per site, remembered by software. POINT checks new passwords against known leaked lists and will tell you if yours has shown up in a breach somewhere else.
What POINT won't do
There's no back door. If you lose your email, your authenticator and your recovery codes, support can't log you in, because a support person who can bypass two-step login is a support person who can be talked into it by someone pretending to be you. That's how real takeovers happen.
So the protection is the setup, done once, today: two-step login on, codes saved somewhere safe, email current. Ten minutes, and your account is yours for as long as you want it.