Credential Stuffing Is Not a Login Page Problem. It Is an Account Takeover Pipeline.

November 2, 2026 - RiskRampart

Credential stuffing starts with a list. Breached email and password pairs, sold in bulk, are replayed against a login endpoint by bots that rotate residential proxies, solve or outsource CAPTCHAs, and throttle themselves to sit under naive rate limits. The success rate on any one pair is low. At a hundred million pairs it does not need to be high. Each account that opens is inventory: a stored payment method, a points balance that transfers, a trusted account age that makes the next fraud cleaner. Retailers who measure the attack by login failures are measuring the cheap part.

Signals that survive proxy rotation

IP rate limiting fails first because the traffic arrives from clean looking residential addresses, a handful of attempts per address. What survives rotation is behaviour and composition: the ratio of failed to successful logins across the whole endpoint, attempts against accounts that have never logged in from the challenging geography, password lengths and patterns consistent with a breach corpus rather than with your own users, and a success followed within seconds by a password change, email change, or a points transfer attempt. That last sequence is the highest value signal in the chain, and it lives in your account event logs, not in your WAF. Join them, or the detection story stays half told.

Break the chain after the login, not only at it

You will not stop every stuffed login, especially where customers reuse passwords from breaches you have never heard of. You can make a successful one worthless. Step up verification when a login is followed by a sensitive change, hold points transfers and gift card purchases from freshly accessed dormant accounts for review, and notify the account holder out of band on email or password changes with a route to lock the account that does not itself require the password. MFA helps where customers adopt it, and adoption is the constraint: mandatory MFA on high value events, rather than on every login, usually buys most of the protection at a fraction of the friction.

Screen credentials against breach corpora, carefully

Checking new and changed passwords against known breached password lists, using a k anonymity service or a local corpus, stops the next stuffing list at the source: the reused password never gets set. Screening at login, flagging accounts whose current password appears in a fresh breach and forcing a reset, is stronger medicine and needs a support plan for the spike it creates. Either way, communicate the reason plainly. Customers told their password appeared in a data breach elsewhere act. Customers handed a vague security message postpone, and the account stays on the list the bots are already holding.

Report the attack as a pipeline, not an incident

A stuffing wave has a beginning, but the accounts it opened are used over following weeks, often by different buyers of those accounts. Track compromised accounts as a cohort: how they were identified, what was taken, how long between access and exploitation. That cohort view is what justifies the unglamorous investments, login telemetry retention, event joins, step up tooling, to a business audience. A report that says we blocked forty million attempts invites the reply that nothing was lost. A report that names the accounts, the points, and the chargebacks prices the problem honestly.

Keep reading

Frequently asked questions

What is credential stuffing?

An attack where bots test large lists of breached username and password pairs against a login page, exploiting password reuse. Successful logins lead to account takeover and theft of stored value.

Why does IP rate limiting not stop stuffing?

Attackers rotate through residential proxy networks, sending few attempts per address, so per IP limits see normal looking traffic. Behavioural and account level signals are needed as well.

What should trigger step up verification?

Sensitive actions soon after login, especially on dormant accounts: password or email changes, points transfers, gift card purchases, and new payment or shipping details.