Even with multi-factor authentication enabled at Reed, accounts can still be compromised. This extra verification step is a tool to help thwart hackers and keep college data safe.
Consider this real-world example... A phisher sets up a fake webpage with an identical-looking Reed login page. You enter your Reed username and password on the fake login page, effectively handing over your login credentials to the phisher. Now, the phisher uses those same credentials to immediately log into a real Reed website (such as IRIS), which then sends a Duo push to your phone. You accept the request, thinking you received it because you were just trying to log into (what turned out to be a fake) Reed website. Now the phisher has full access to your Reed account--can read/send emails, access your Google Drive files, see your W-2 through Employee Self-Service, etc.
