Sign up for freeSign up

Change your password? Maybe not: must have, might have and can't have for alerts

With past modals of deduction, learners work out what happened behind a suspicious login in this B2 English for IT lesson plan.

Grammar
Must have, might have and can't have + past participle for how sure you are about the past, with continuous and passive forms: They must have been testing a list.
Topic
A suspicious login on a merchant's account at a fictional payments startup, with words such as a breach, phishing, credential stuffing and password rotation.
Activities
A story about password advice, a security thread, a call, self-checking drills, a chat with a worried merchant and boxes of mysteries, then an investigation summary and a recorded talk.

What's inside

  1. Chapter 1Warm-up: Who Knows Your Password?

    • PictureUnlock
    • Spin the wheel and talk about security at workSpin the wheelUnlock
    • Study the security vocabularyVocabularyTry it
    • Choose the word for each pictureChoose by pictureUnlock

  2. Chapter 2The Story: Change It? Maybe Not

    • Read the story of NIST's password adviceArticleUnlock
    • Choose the correct answer about the storyQuizUnlock

  3. Chapter 3At Work: A Login at 3 a.m.

    • Read the thread in the security channelReal-life documentTry it
    • True or false? Check the threadTrue or falseUnlock
    • Choose the conclusion each piece of evidence supportsQuizUnlock

  4. Chapter 4Listen: What Must Have Happened?

    • Listen to Fatima and Diego prepare the callListeningTry it
    • Transcript, for the teacherUnlock
    • Choose the correct answer about the callQuizUnlock

  5. Chapter 5Grammar: It Must Have Leaked

    • Study the scheme: past modals of deductionGrammar schemeTry it
    • Choose the correct option: how sure is the speaker?Choose the optionUnlock
    • Fill in the gaps: rewrite each sentence with a past modalFill in the gapsUnlock
    • Fill in the table: make the past participleFill in the tableTry it
    • Choose the correct sentenceQuizUnlock
    • Drag the words into the gaps in the team chatDrag and dropUnlock

  6. Chapter 6Speak Up: Calm, Clear and Careful

    • Choose the best replies to a worried merchantChatTry it
    • Open a box: solve the security mysteryOpen the boxUnlock

  7. Chapter 7Homework: Confirmed or Just a Guess?

    • Read your phrase bankReal-life documentUnlock
    • Choose the correct option to complete the summaryChoose the optionUnlock
    • Match the sentence halvesMatchUnlock
    • Write an investigation summary: confirmed or a guess?Writing, checked by the teacherUnlock
    • Record a short talk about your security habitsSpeaking, checked by the teacherUnlock

25 exercises in 7 chapters. Start a 7-day free trial to open all of them, copy any part into your own lessons, and teach the lesson live.

Vocabulary

12 words and phrases from the lesson, each with a picture and audio in edio.

+9 more with pictures and audio in the lessonMore words

  • phishing
  • a breach
  • credential stuffing
  • a passphrase
  • password rotation
  • leak
  • break into
  • give away
  • lock someone out

Grammar: past modals of deduction

Past modals of deduction say how sure you are about something that has already happened, based on the evidence: must have for “I'm sure it happened”, might, may or could have for “it's possible”, and can't have for “I'm sure it didn't”. Each one is a modal, have and a past participle, and have never changes.

Past modals of deduction: what happened?

Start from the evidence. Then show how sure you are about the past.

From sure to impossible

Four levels of certainty, from yes to no: No failed attempts: they must have known the password. She might have given it away on a phishing page. She may not have used a password manager. Nobody entered the code, so they can't have seen her payments.

How sure?FormExample
I'm sure it happened.must have + past participleNo failed attempts: they must have known the password.
It's possible.might / may / could have + past participleShe might have given it away on a phishing page.
Maybe it didn't happen.might not / may not have + past participleShe may not have used a password manager.
I'm sure it didn't happen.can't / couldn't have + past participleNobody entered the code, so they can't have seen her payments.

Simple, continuous, passive and questions

Have + past participle tells what happened. For an action in progress, use have been + -ing: They must have been testing a list. For the passive, have been + past participle: The password might have been stolen. In questions, the modal comes first: Could they have guessed it?

ShapeFormExample
Simple: what happenedmodal + have + past participleHer password must have leaked in the breach.
Continuous: in progress at that timemodal + have been + -ingThey must have been testing a list of passwords.
Passive: what was done to itmodal + have been + past participleThe password might have been stolen from the forum.
Questionmodal + subject + have + past participleCould they have guessed it?

Evidence first, then the conclusion

A deduction is stronger with its evidence in front: Nobody entered the code, so they can't have broken into the account. After have, irregular verbs need the third form, not the past simple: broken, given, gone, stolen, known.

Evidence first, then the conclusion

the evidencesomodal + have + past participle

The login came from a new country at 3 a.m., so someone else must have used her password.

Nobody entered the code, so they can't have broken into the account.

After have, use the past participle

  • break → broke → broken
  • give → gave → given
  • go → went → gone
  • see → saw → seen
  • steal → stole → stolen
  • know → knew → known
  • be → was / were → been
  • Regular verbs: leak → leaked, guess → guessed, click → clicked

Can't have, not mustn't have

For “I'm sure it didn't happen”, use can't have or couldn't have; mustn't is for rules, as in You mustn't share passwords. For a possibility, use might, may or could have, never can have. Could have can also mean a missed chance: We could have caught it earlier.

can't have, not mustn't have; could have, not can have

For “I'm sure it didn't happen”, use can't have or couldn't have: They can't have guessed it. Mustn't is for rules (You mustn't share passwords). For “it's possible”, use might, may or could have, never can have. And could have can also mean a chance you missed (We could have caught it earlier). Here it means “maybe it happened”.

One alert, six sentences

The examples follow a team from the evidence to its conclusions: Whoever it was can't have guessed the password. They must have known it already. She must have been asleep when the code arrived.

  • Whoever it was can't have guessed the password. They must have known it already.
  • They must have been testing a list of leaked passwords.
  • Her password must have leaked in the forum's breach.
  • She might have given it away on a phishing page, too.
  • She must have been asleep when the code arrived.
  • Could she have clicked a phishing link?

Typical mistakes

  • The password must had leaked in the breach.

    The password must have leaked in the breach.

    modal + have, never had

  • They mustn't have guessed it on the first try.

    They can't have guessed it on the first try.

    for “I'm sure it didn't happen”, use can't / couldn't have

  • She can have clicked a fake link.

    She might / may / could have clicked a fake link.

    for a past possibility, never can have

  • She might have went to a fake login page.

    She might have gone to a fake login page.

    the past participle (gone), not the past simple (went)

More lessons on this grammar: Modal verbs lessons and exercises

Try the past modals of deduction exercises

Try them yourself: these are the same exercises your students do in edio.

More exercises

What's in the lesson

  • 13 auto-checked exercises
  • 2 games
  • 2 teacher-checked tasks
  • 2 real-life documents
  • 1 article
  • 1 grammar scheme
  • 1 set of word cards
  • 1 audio clip
  • 1 picture
  • 1 transcript

The main objectives of this lesson are to:

  • say what you're sure happened, from the evidence: No failed attempts, so they must have known the password.
  • say what's possible and what's impossible: She might have given it away on a phishing page. They can't have seen her payments.
  • use the continuous and the passive: They must have been testing a list. It might have been stolen.
  • write an investigation summary that keeps confirmed facts apart from guesses, and calm a worried user in a chat

Lesson 20 is the middle lesson of AI, security and ethics, unit 7 of English for IT B2 · Beyond the Code, where learners discuss AI tools and security habits and agree on team rules. It moves the modals of deduction of lesson 11 (It must be the cache) into the past, and lesson 21 closes the unit with a team policy for AI tools. An alert is evidence of something that already happened, so how sure you sound matters.

A wheel about passwords and alerts opens the lesson, and twelve word cards with pictures and audio add a suspicious login, credential stuffing, password rotation and lock someone out. The story explains why NIST stopped recommending forced password changes in 2017 and what its 2025 revision says. At work, students follow a thread in the security channel about a 3 a.m. login and match evidence with conclusions. In an AI-voiced call, Fatima and Diego prepare her call back to the merchant. The grammar chapter has the scheme and five self-checking drills, among them a table that turns evidence into a conclusion. Students then calm the worried merchant in a support chat and open boxes of security mysteries.

Homework opens with a phrase bank for investigating an alert, then a choice drill that completes a team summary and sentence halves to match, both self-checking. Students then write an investigation summary that keeps confirmed facts apart from guesses and record a talk about their security habits, two tasks the teacher reviews.

Grammar:
past modals of deduction · must / might / can't have
Topic:
security · passwords · investigating an alert

Teaching tips

  • Start with an everyday mystery: a colleague's mug is gone, the printer is warm, the door is open. Learners give one must have, one might have and one can't have for each, with the evidence.
  • Make two columns while students read the thread, Confirmed and Not confirmed, then turn each line into a sentence with the modal it deserves.
  • Drill the participle before the modal: call out steal, go or break, and students answer with might have been stolen, can't have gone or must have broken, since might have went is the error that sticks.
  • With in-company groups, replay a real incident with no names or data: one learner plays the worried user, another explains calmly what must have happened and what can't have.

Liked it?

Teach the whole lesson in edio

25 exercises in 7 chapters, ready to teach. edio is an online platform for language schools and teachers: ready-made interactive lessons, live classes, homework and student progress in one place.

  1. Start a free trial

    7 days, no credit card.

  2. Open the lesson

    Find it in the library of 621 ready lessons. Teach it as it is, or copy any chapter into your own lessons.

  3. Teach it live or as homework

    Students work in their own accounts, in sync with you during the lesson, and the practice exercises check themselves.

Teach it free for 7 days

The whole course: English for IT B2 · Beyond the Code

24 lessons at B2 for software teams, in American English. A year on at Kestrel Cloud, a fictional payments startup, Iryna and her team estimate work, write docs and postmortems, argue trade-offs, give demos and negotiate scope. Each lesson starts from a real case, from the Apollo 11 alarms to Conway's law.See the course

  1. Unit 1 Planning and estimates

    estimates and deadlines: approximating numbers, the future continuous and perfect, likelihood

    1. Lesson 1It always takes longerApproximating numbers in estimates
    2. Lesson 2By New Year's Eve, we'll have fixed itFuture continuous and future perfect
    3. Lesson 3Let's play planning pokerLikelihood with bound to, likely to and may well

  2. Unit 2 Docs people read

    specs and design docs: modals for requirements, participle clauses, plain English

    1. Lesson 4MUST, SHOULD or MAY?Modal verbs for requirements in specs
    2. Lesson 5Four kinds of docsParticiple clauses in documentation
    3. Lesson 6Just a request for commentsPlain English for design docs

  3. Unit 3 Incidents and postmortems

    telling an incident without blame: narrative tenses, the passive, the third conditional

    1. Lesson 7The 1202 alarmNarrative tenses for incident stories
    2. Lesson 8Blameless by designActive vs passive voice in a postmortem
    3. Lesson 9If we had had an alert…The third conditional: a different past

  4. Unit 4 Architecture and trade-offs

    comparing options and recording decisions: contrast linkers, modals of deduction, mixed conditionals

    1. Lesson 10Your system copies your org chartContrast linkers for comparing options
    2. Lesson 11It's always DNSModals of deduction for troubleshooting
    3. Lesson 12Write down the whyMixed conditionals for looking back on decisions

  5. Unit 5 Demos and tech talks

    a clear structure on stage: signposting, cleft sentences, describing trends

    1. Lesson 13The mother of all demosSignposting language for demos
    2. Lesson 1420 slides, 15 secondsCleft sentences for emphasis
    3. Lesson 15Numbers that tell a storyDescribing graphs and trends

  6. Unit 6 Stakeholders and scope

    saying no and finding yes: diplomatic language, as long as and unless, negotiating

    1. Lesson 16Pay down the debtDiplomatic language for hard messages
    2. Lesson 17Why meetings argue about the bike shedAs long as, provided, unless and otherwise
    3. Lesson 18Yes, if…Negotiating language for scope and deadlines

  7. Unit 7 AI, security and ethics

    AI tools, passwords and team rules: be used to and get used to, past modals of deduction, purpose linkers

    1. Lesson 19Your new pair programmerUsed to, be used to and get used to
    2. Lesson 20 · you're hereChange your password? Maybe notPast modals of deduction
    3. Lesson 21Rules for AI at workPurpose linkers for rules with a reason

  8. Unit 8 Growing your career

    feedback, retros and goals: phrasal verbs, reporting verbs, wish and if only

    1. Lesson 22Your next levelCareer phrasal verbs and goal frames
    2. Lesson 23Feedback that helpsReporting verbs and their patterns
    3. Lesson 24Start, stop, continueWish and if only for wishes and regrets

Questions about this lesson

How do you use must have in English?
Use must have + past participle when you're sure something happened, because the evidence leaves no other answer: There were no failed attempts, so they must have known the password. Her password must have leaked in the breach. The negative is can't have, not mustn't have. Don't confuse it with must for rules, or with the noun a must-have, something you can't do without.
What are past modals of deduction?
Past modals of deduction show how sure you are about the past, based on evidence. Must have means you're sure it happened; might, may or could have, that it's possible; might not have, that maybe it didn't; and can't have, that you're sure it didn't: They can't have guessed it. They must have known it already. The B2 lesson Change your password? Maybe not on edio.ai uses them to investigate a suspicious login.
When do you use might have?
Use might have + past participle for a past possibility, when the evidence isn't enough to be sure: She might have given her password away on a phishing page. May have and could have work the same way. Might not have means “maybe it didn't happen”: I closed it at once, so I might not have typed anything. Never use can have here: She can have clicked a fake link is wrong.
What does must have been mean?
Must have been is a sure conclusion about a past state: She must have been asleep when the code arrived. With -ing, it describes an action in progress: They must have been testing a list of leaked passwords. With a past participle, it's passive: The alert must have been sent automatically. In each case, you didn't see it happen, but the evidence points one way.
How do you use can't have in English?
Use can't have + past participle when you're sure something didn't happen: Nobody entered the code, so they can't have broken into the account. Couldn't have means the same: They couldn't have seen her payments. It's the opposite of must have, and the evidence usually comes first. In Change your password? Maybe not, a B2 lesson on edio.ai, students reassure a merchant with It can't have been them.
How do you form modals of deduction in the past?
Put have and a past participle after the modal: must have known, might have leaked, can't have seen. For an action in progress, use have been + -ing: They must have been testing a list. For the passive, use have been + past participle: It might have been stolen. Questions start with the modal: Could they have guessed it? Have never changes to had or has.
Is it "mustn't have" or "can't have"?
For a sure negative deduction, it's can't have or couldn't have: They can't have guessed it on the first try. Mustn't is for rules, as in You mustn't share passwords, so They mustn't have guessed it is a mistake. In American English, the full form must not have is also common for a deduction: She must not have seen the alert. For a possibility, never use can have: say might have.
Is it "might have went" or "might have gone"?
It's might have gone, with the past participle: after have, every past modal takes the third form of the verb, not the past simple. So it's She might have gone to a fake login page and The password might have been stolen. Check irregular verbs in pairs: went, gone; stole, stolen; broke, broken. A table in Change your password? Maybe not, a B2 lesson on edio.ai, drills eight such participles.
What do the NIST password guidelines say about password rotation?
The NIST password guidelines advise against scheduled password changes, known as password rotation. NIST's 2017 guidance recommended against them because frequent forced changes lead to weaker, more predictable passwords; its 2025 revision says systems must not require them. A change is still needed when there's evidence a password was stolen. Written for US government systems, the guidelines serve many organizations as a reference. The short version: Change it because of evidence, not the calendar.
What does credential stuffing mean?
Credential stuffing is trying stolen sign-in details on many other sites, in the hope that people reuse their passwords. A security engineer might write: That's credential stuffing: they must have been testing a list of leaked passwords. The defense is a different password for every account, ideally a long passphrase kept in a password manager, with two-factor authentication on.
How do I teach past modals of deduction to B2 adults?
Give the evidence first and let learners draw the conclusion: No failed attempts, so… becomes they must have known the password. Sort conclusions into sure, possible and impossible, then add the continuous and passive forms. A mystery from work keeps it real, and a calm-the-user role-play adds tact: We can't be completely sure, but it might have leaked in the breach. The support chat in the B2 lesson Change your password? Maybe not on edio.ai practices it.
Are there interactive exercises for past modals of deduction?
Yes: self-checking tables, gap-fills and chats give instant feedback on each form. This page plays four parts of Change your password? Maybe not, a B2 English for IT lesson on edio.ai, without an account: a security thread about a 3 a.m. login, a call in which Fatima and Diego prepare to phone the merchant back, a table that turns verbs into past participles and a chat with a worried merchant. The other drills are locked.
Unlock full lesson

Teach this lesson with your students

Book a demoStart free trial

No credit card required