Credential Stuffing

Credential stuffing is a cyber attack in which criminals take usernames and passwords exposed in one data breach and try them automatically on the login pages of many other websites and apps. Because many people reuse the same email address and password across services, a small share of attempts succeed, giving the attacker access to bank accounts, payment wallets, online shops, loyalty schemes and email inboxes. It is one of the most common routes to account takeover.

Credential stuffing differs from brute-force guessing, which tries many possible passwords against a single account. It uses known pairs of real credentials and relies on volume rather than guesswork. It is usually carried out with bots and is a type of bot attack, often combined with techniques that disguise the source of the traffic.

1. Obtaining credentials. Attackers buy or download lists of email and password pairs from past breaches, phishing campaigns or malware logs. Such lists can contain hundreds of millions of entries.
2. Preparing tools. They use automation software configured for the target's login page, including how to handle cookies, form fields and responses.
3. Hiding the traffic. Requests are spread across large numbers of IP addresses, often residential proxies, and the tools may imitate real browsers and devices, a technique related to device spoofing.
4. Testing at scale. The tools submit each pair and record which ones log in successfully.
5. Exploiting or selling access. Working accounts are used directly or sold to other criminals.

Success rates per attempt are low, but because attacks involve millions of attempts, even a small percentage produces many compromised accounts.

In banking and payments, a successful login can allow criminals to transfer money, add new payees, change contact details, order cards or apply for credit in the victim's name. In e-commerce, stored cards and wallets can be used to buy goods, and loyalty points or gift card balances can be drained. Even failed attacks cause harm: they overload systems, lock legitimate customers out after too many failed attempts and generate costs for investigation and customer service. Firms that suffer account takeover may face reimbursement claims, regulatory scrutiny and reputational damage, even though the original breach happened elsewhere.

Credential stuffing is related to enumeration attacks, where bots test whether email addresses or card numbers are valid, and to card testing, which uses similar automation against payment forms.

Defences work at several layers:

• Stronger authentication. Multi-factor authentication makes a stolen password insufficient on its own. Passkey authentication removes reusable passwords altogether.
• Bot management. Tools analyse traffic patterns, browser characteristics and behaviour to separate automated logins from human ones, and may present challenges such as CAPTCHAs.
• Rate limiting and reputation. Limiting login attempts per IP address, device or account, and using IP reputation data to block known proxy and data centre addresses.
• Device and behaviour signals. Device fingerprinting and behavioural biometrics help spot logins that do not match a customer's usual pattern.
• Breached password checks. Comparing new and existing passwords against known breach lists and prompting users to change them.
• Risk-based controls. Using risk-based authentication to step up checks on suspicious logins and to hold sensitive actions, such as adding a payee, for review.

Firms also monitor for signs that an attack is under way, such as a sudden rise in failed logins, many logins from new devices or a spike in password reset requests, and they share indicators with industry peers.

The root cause of credential stuffing is password reuse. Using a password manager to create a unique password for each service, and switching on two-step verification wherever it is offered, greatly reduces personal risk. Breach notification services let individuals check whether their details appear in known leaks. Organisations increasingly avoid relying on users alone, however, and design login systems on the assumption that some customer passwords are already in criminals' hands.

Data protection laws require firms to protect personal data with appropriate security, and regulators have taken action against companies that suffered large-scale account takeover without reasonable defences. In payments, rules such as strong customer authentication in Europe require more than a password for account access and payments, which limits what a credential stuffing attacker can do with a password alone. Disputes over who bears losses from compromised accounts depend on local consumer protection rules and on whether the customer acted with gross negligence.