 may have your password, but they don't have the app on your phone that's generating this, what's called two factor authentication. So that is the best way to protect it, along with being aware that hackers are always trying to get into your account.