It always starts innocently. You sign up for one more service — a food-delivery app, a streaming trial, a forum you'll visit twice — and the box asks for a password. You're tired, so you type the same...

You set up two-factor authentication years ago, texted yourself a code, and felt safer. For a while, you were. But the login screen you trusted has quietly changed underneath you. The six-digit code a...
