Credential stuffing: How it works, what it costs and how to stop it

What credential stuffing is

Credential stuffing is an automated attack that takes username and password pairs stolen in one breach and tries them on unrelated sites. Nothing is guessed. The attacker already holds working credentials for somewhere; the bet is that the owner reused them with you.

The bet pays because reuse is common. A Keeper Security survey found 44% of employees use the same password for personal and work accounts. The attack is also cheap: success rates sit under 2%, but a bot working through a million pairs still hands over thousands of accounts.

Brute force vs credential stuffing vs password spraying

The three are often lumped together. They need different defenses, so it pays to separate them.

Brute force

Brute force guesses. The attacker tries combination after combination against one account until something works, with no prior knowledge needed. A 2025 estimate had about 51% of attackers still using it, often against cloud services with guessable admin usernames.

A tool runs "password1", "password2" and on up to "password999999" against a single login. Weak choices like "123456" fall in seconds; the attacker's only costs are time and requests.

Credential stuffing

Credential stuffing replays real pairs stolen elsewhere. The attacker tries each once per site and moves on, relying on reuse: 81% of people use the same password on more than one site. At a 2% hit rate, a million stolen pairs become 20,000 or more hijacked accounts.

Say a million logins leak from an old gaming forum. Bots try those same pairs against banks, retailers and email providers. Even at 1 to 2%, that is thousands of working accounts.

The supply side is what makes this work. Each breach feeds the pool. The pairs are sold, traded or dumped on forums and dark web markets, sometimes billions at a time, then loaded into bots and fired at every platform worth money.

Password spraying

Password spraying flips the ratio: one common password, such as "Password123", against many accounts. A 2022 government advisory named it a favored technique of state-sponsored groups.

An attacker tries "Welcome2024" against every employee account at a company, waits long enough to stay under lockout thresholds, then tries "Summer2024" across the same list.

Rotating accounts instead of passwords sidesteps the lockouts that fire after repeated failures on a single account. Weak corporate password policies do the rest.

The table compares the three side by side.

How credential stuffing works, step by step

An attack runs through four stages:

1. Sourcing leaked credentials
2. Loading them into bots
3. Running login attempts at scale
4. Harvesting the hits

1. Sourcing leaked credentials

• Most pairs come from data breaches. Over 15 billion stolen credentials from around 100,000 breaches circulate on cybercrime forums and dark web markets.
• Phishing campaigns and malware such as keyloggers add fresh pairs.
• The resulting "combolists" are bought, sold and shared, so one breach feeds attacks for years.

2. Loading them into bots

• Tools such as OpenBullet, Sentry MBA and SNIPR take a credential list and a site config and run logins across many targets at once.
• Bots rotate IPs through proxies or botnets to slip under rate limits and IP blocks.
• Current bots mimic human timing, solve simple CAPTCHAs and blend into normal traffic.

3. Running login attempts at scale

• Bots push millions of pairs into login forms or APIs, varying timing, geolocation and device type to avoid patterns.
• To dodge lockouts, each account usually sees one attempt before the bot moves on.
• Hit rates run 0.2% to 2%. A million pairs yields 2,000 to 20,000 compromised accounts.

4. Harvesting the hits

• Working pairs are logged as "hits".
• Hits are used to drain stored value, commit payment fraud or steal data, or are sold on in bulk.
• On the defending side, the attack shows up as spikes in failed logins, traffic from many new IPs, off-hours surges and a sudden shift in the success-to-failure ratio.
• Behavioral analytics, device fingerprinting and anomaly detection catch it earliest.

What credential stuffing costs

Credential stuffing hits every sector that keeps money or data behind a login. The direct loss is fraud; the indirect losses are support load, downtime, regulatory exposure and churn.

Four sectors take the most traffic.

Industries most targeted

• Ecommerce
• Financial services
• Media and streaming
• Healthcare

Ecommerce

Credential stuffing makes up as much as 91% of login traffic to ecommerce sites during peak seasons. Compromised accounts hold saved cards, order history and loyalty balances. In July 2022, The North Face was hit by a credential stuffing attack that exposed nearly 195,000 accounts.

The fraud is only part of the bill. Lockouts and password resets pile onto support, and customers blame the store, not the site where the password leaked. One earlier projection put global ecommerce losses from credential stuffing at $17 billion for 2024, counting fraudulent purchases and clean-up.

Financial services

Banks and credit unions are targets because the accounts hold money and the data behind it. A hit means unauthorized transfers, fraudulent transactions and identity theft. A single credential stuffing breach at a financial institution runs to millions once fraud, fines and reputational damage are added up.

The volume forces banks into heavy spending on MFA and machine learning detection to keep up.

Campaigns against financial institutions test thousands of stolen pairs per second, around the clock.

Media and streaming

Streaming accounts are stolen for the subscription itself. The attacker gets paid content without paying, or resells access, and the service loses the revenue.

Akamai counted over 17 billion credential stuffing attempts against media companies across 2018 and 2019, among the highest of any vertical.

Spotify has dealt with repeated credential stuffing attacks over several years, some touching hundreds of thousands of accounts, with attackers changing account details and using the access.

Healthcare

Healthcare accounts hold personal health information, and the sector's defenses have lagged. Stolen credentials are used for medical fraud, prescription drugs, false insurance claims and identity theft, and they sell at a premium on the dark web.

One 2024 count put compromised healthcare-related credentials at more than 3.2 billion for the year, up 33% on 2023.

The table below lists the main risk in each sector and how attackers cash out the accounts.

How to detect a credential stuffing attack

An attack in progress leaves signs in your login telemetry. These are the indicators of compromise worth alerting on.

Indicators of compromise

1. Unusual login patterns
2. Spikes in failed login attempts
3. Logins from odd geographies
4. Device and browser fingerprint mismatches

1. Unusual login patterns

A user who logs in once or twice a day suddenly shows dozens of attempts in a few minutes, or logins at 3 a.m. from someone who has never logged in outside office hours.

Rapid attempts far above a user's baseline usually mean a bot is working through a list, not a person who forgot their password.

2. Spikes in failed login attempts

Thousands of failed logins in an hour, spread across many different accounts rather than concentrated on one.

That shape is the signature of stuffing: each stolen pair is tried once, most fail, a few succeed. Watch the failure count and the success-to-failure ratio together.

3. Logins from odd geographies

A user who always logs in from Mumbai suddenly logs in from Europe and South America within the same hour. Attackers route through proxies and botnets in other regions to hide their origin; impossible travel like this points to a compromised account.

4. Device and browser fingerprint mismatches

An account that has only ever been used from Chrome on a Windows laptop is suddenly accessed from Firefox on a phone running an operating system you have never seen for that user. A fingerprint change at login is a strong sign that someone other than the owner holds the password.

Tools and techniques for detection

Catching the attack early limits the damage. Four techniques do most of the work: SIEM correlation, behavioral analytics, velocity checks and honeypots.

SIEM pattern correlation

A SIEM (security information and event management) tool collects logs and events from across your environment and analyzes them in one place.

Pattern correlation links events that look harmless alone. Several failed logins on one account from different locations in a few minutes might not trigger anything. A successful login from one of those locations a moment later does, because the sequence matches credential stuffing. The SIEM raises a high-priority alert and the team can act before the account is used.

Typical SIEM features:

• Real-time monitoring and behavioral analytics
• Automated alerts and response workflows
• Event aggregation and correlation across network devices, servers, applications and security hardware
• Threat intelligence feeds and analytics for multi-step attack patterns
• Compliance reporting and audit support

The figure below lists prominent SIEM platforms, their strengths and who they suit.

The checklist below compares SIEM tools on the features that matter.

Behavioral analytics

Behavioral analytics builds a baseline for each user: usual login times, locations, devices and the resources they touch. Anything off the baseline, such as a login from a new country, a run of failures or a sudden grab at sensitive data, gets flagged for review or an automatic response.

Over 80% of web application breaches involve stolen or reused credentials, the same raw material credential stuffing runs on. Behavioral analytics spots the automation behind it: login velocity no human produces, device fingerprints that do not match the account, access patterns out of character. It can trigger an MFA challenge or a block before the attacker is in.

Passwords alone no longer hold, with AI-assisted cracking tools and remote work widening the attack surface. Behavioral analytics adds a layer that keeps learning what normal looks like, so the team catches the early signs of stuffing with fewer false positives.

The table below walks through the steps for setting up and maintaining a behavioral analytics program, from objectives to tuning.

Velocity checks and honeypots

Velocity checks measure how fast and how often an action happens. Two logins from distant cities within minutes ("impossible travel"), a burst of file downloads or several privilege changes in a day all point to a compromised account or an insider.

To make them work:

• Set thresholds, for example more than one login from geographically distant locations within 30 minutes, or more than two privilege escalations in a day.
• Alert on breaches of those thresholds in real time.
• Combine velocity with device type and login behavior to cut false positives.
• Retune the thresholds as normal activity and attacker behavior change.

Honeypots

A honeypot is a decoy server, file, service or account that looks worth attacking. Nobody legitimate touches it, so any interaction is an attacker doing reconnaissance, and you see them before they reach real assets.

To make them work:

• Run several kinds, mimicking servers, databases, admin consoles and files.
• Log everything that touches them: IP addresses, tools, tactics.
• Rotate and reconfigure them so attackers cannot learn to avoid them.
• Make them look like the rest of the environment.

Why run both

Velocity checks and honeypots together let you:

• Catch suspicious behavior that would otherwise pass.
• See attacker tactics before any real damage.
• Triage faster and shorten containment time.

How to stop credential stuffing

No single control stops it. You need front-end controls on the login, credential hygiene behind it and bot mitigation in front of both.

Front-end controls

Front-end controls sit on the login page itself and stop most automated attempts before they touch your authentication backend.

• CAPTCHA and rate limiting. Challenge suspicious logins and cap attempts per IP or device within a time window.

Blocking more than five failed attempts per minute, for instance, cuts automated success sharply. Cloudflare's 2023 data put rate limiting alone at 78% of credential stuffing attempts blocked; a 2022 Akamai report put the figure above 90% once bot detection such as reCAPTCHA is layered on.

• Device fingerprinting. Recognize devices by browser, OS, IP and configuration, and step up verification when a never-seen device tries an account.
• Behavioral biometrics. Typing speed, mouse movement and touch patterns build a profile per user; a login that does not match it triggers adaptive authentication or a block.

Credential hygiene

Credential hygiene is how passwords get created, stored and managed. Strong, unique passwords and a check against known leaks remove most of what credential stuffing feeds on.

Three controls:

• Strong password policy. Require length, discourage reuse and steer people away from common choices. NIST guidance favors long passphrases as both stronger and easier to use. Length beats complexity: a complex 12-character password takes 62 trillion times longer to crack than a 6-character one.
• Block known breached credentials. Check new and existing passwords against leaked-credential databases such as Have I Been Pwned and refuse the ones that appear. A stolen pair that cannot be set cannot be stuffed.
• Mandatory MFA. Enforce multi-factor authentication for every user, with no exceptions for sensitive accounts or high-value actions. JumpCloud's figures put organizations with mandatory MFA at 99.9% fewer account takeovers from stolen credentials.

Bot mitigation

Bot mitigation filters automated traffic before it reaches the login. Three layers:

• Web application firewall (WAF). Filters and blocks malicious traffic, including stuffing attempts, by pattern, IP and geography.
• Bot management platform. Uses machine learning to separate sophisticated bots from people, with visibility into bot traffic and per-request options to block, rate-limit or challenge.
• Progressive challenges. Start invisible, escalate to a CAPTCHA, then to out-of-band verification if the risk signals persist. Real users rarely see a challenge; bots hit a wall.

What organizations should put in place

Beyond the login controls, four practices lower your exposure and shorten response when an attack lands.

Preventive measures

Prevention is the cheapest defense. The four measures below cut the odds of a successful attack.

1. Monitor credential dump forums

Watch the dark web and open forums where stolen credentials trade. Threat intelligence services such as Flashpoint and Recorded Future scan over 25,000 illicit sites for leaked data. If 2,000 of your users' credentials turn up in a dump, you can force resets on those accounts the same day, before the list is loaded into a bot.

Cyberint, a threat intelligence firm, reported leaked credentials up 160% year on year in its 2025 figures.

2. Run credential stuffing simulations

Test your own login with tools such as OWASP ZAP or custom scripts. A 2024 survey found 82% of enterprises running red team simulations turned up gaps they had missed in their login flows, such as weak rate limits and no breached-password check.

Companies that run annual attack simulations are 2.5 times less likely to suffer a major account compromise than those that do not test.

3. Train staff and segregate access

Teach employees to recognize phishing and enforce least privilege. Kaiser Permanente has been cited as cutting phishing clicks by 70% with quarterly training, and CISA as documenting a 40% drop in credential misuse at healthcare providers that segregated access.

4. Incident response readiness

Preparation before the attack decides how much damage it does. Readiness means your team can detect, contain and recover without improvising.

Response playbook for credential stuffing

• Write a playbook that covers how to detect an attempt (login anomalies, velocity checks), the automated first response (lock affected accounts, force resets), who notifies users and internal stakeholders, and how escalation to the incident response team works.
• Rehearse it with simulated attacks to find the gaps.

Twilio, for example, has been credited with containing a 2023 attack within 12 hours after refining its playbook through quarterly simulations, with account lockouts and SMS alerts automated.

Notification obligations (GDPR, CCPA)

Your notification steps have to meet the regulations you fall under.

• Map every breach notification law that applies, such as GDPR and CCPA.
• Put the deadlines in the playbook. GDPR requires notification within 72 hours.
• Automate notifications where you can, for speed and an audit trail.
• Have legal counsel review the procedure every six months.

User communication templates

Write the emails and in-app notices before you need them. One account credits Chase Bank's templated alerts during a 2022 credential attack with 90% of affected users resetting passwords within 24 hours and an 80% smaller attack window (JPMC, 2023). Google and Akamai data has been cited for standardized messaging lifting user response rates by up to 85%.

What a good template does:

• Tells the user plainly what happened and that their password should be reset now.
• Walks them through the reset and the next step, usually enabling MFA.
• Gets tested on a small segment first and tightened for clarity.
• Gets refreshed quarterly with legal, IT and support in the room.

Checklist: Seven controls against credential stuffing

1. Block known breached credentials at login

Connect your authentication system to a breached-credential database (Have I Been Pwned or a commercial API). Check every login and every new password against it; on a match, deny the login or force a reset.

• Compare hashed credentials against breach lists by API.
• Alert the user and force a reset when a compromised password is used.

2. Enforce MFA on every external-facing app

Require MFA on every application reachable from outside: account portals, webmail, cloud platforms.

• Offer authenticator apps, hardware tokens or SMS codes.
• Make enrollment mandatory and block access until it is done.

3. Deploy bot protection

Put a bot management platform or a WAF with bot detection in front of the login so automated attempts are told apart from people and handled accordingly.

• Commercial options include Akamai, Cloudflare and Radware.
• Configure adaptive challenges, rate limits and device fingerprinting.

4. Monitor and alert on login anomalies

Alert on impossible travel, rapid-fire attempts and runs of failed logins.

• Feed authentication logs into your SIEM or UEBA tool and detect geographic and behavioral outliers.
• Route real-time alerts to the people who will investigate.

5. Add credential stuffing rules to your WAF

Write WAF rules for the attack's signature: excessive login attempts, rate-limit breaches and requests with bot-like behavior.

• Start from vendor-supplied credential stuffing policies and add your own.
• Review and tune the rules as attack patterns change.

6. Track logins from residential proxies

Attackers route login attempts through residential proxy networks because the traffic then looks like it comes from home broadband users. ISPs assign those IPs to ordinary customers, so simple filters trust them, and the attacker slips past geo-blocking and IP rate limits that would catch the same volume from a datacenter range.

• Use a tool that flags proxy-originated logins.
• Step up scrutiny on, or block, traffic from suspect proxy sources.

7. Tell users why password reuse hurts them

Run regular campaigns on password reuse and how to pick unique passwords.

• Use targeted emails, training and reminders on the login page.
• Push password managers so unique passwords cost the user nothing.

Where to start

Start with the two controls that remove the raw material: block known breached passwords at signup and login, and make MFA mandatory. Then watch the login itself for the attack's signature, failed-login spikes across many accounts and traffic from proxies and unfamiliar devices. [Sensfrx](/) scores every login from device, network and behavior signals in real time, so your rules can challenge or block a stuffing bot before it gets a hit.

FAQs