Credential stuffing replays username and password pairs stolen in other breaches against your store, and it works because people reuse passwords. Verizon's 2025 breach report found 22 percent of breaches began with compromised credentials, and 78 percent of confirmed takeovers come from a device the customer has never used.
The playbook, step by step
Step one is the list. Breached username and password pairs circulate by the millions, from breaches at other companies, and the attacker buys or downloads a list that matches your customer base. Step two is the replay: automated tools try the pairs against your login page, thousands per hour, rotating IPs and user agents to stay under the rate limit. Step three is the takeover: a pair that works gives the attacker the account, and the account gives them the stored payment method, the address book, and the order history.
Step four is the monetization, and it is fast. The attacker changes the shipping address, places an order with the stored card, and the goods ship before the real customer notices. The whole cycle, from list to shipped order, can take hours. The customer finds out when the confirmation email arrives, or when the card statement does.
Why a sub-1-percent success rate still pays
Credential stuffing succeeds on well under 1 percent of attempts, and that sounds like a defense. It is not, because the attempts number in the millions. A list of ten million pairs at a 0.5 percent success rate is 50,000 accounts, and 50,000 accounts with stored cards is a business. The low success rate is the reason the attack is automated: no human would try ten million passwords, but a script will, and it will do it overnight.
Verizon's 2025 Data Breach Investigations Report found 22 percent of breaches began with compromised credentials. The median credential stuffing attempt volume is 19 percent of all authentication attempts on a retail site, which means roughly one login in five is an attacker, not a customer. The login page is the most attacked surface on the store, and most stores treat it like a form.
The signals that give the attack away
The first signal is velocity: a burst of login attempts from one IP, or a steady stream of attempts at a rate no human types at. The second is the device. Verizon's data shows 78 percent of confirmed account takeovers originate from a device the customer has never used before. A login from a new device is not proof of fraud, but a login from a new device, at 3 a.m., after five failed attempts, is a pattern.
The third signal is the behavior after login. A real customer browses, searches, and takes time. A stuffed account goes straight to the account page, changes the address, and checks out in minutes. The speed is the tell: the attacker knows what they want, and they do not window-shop.
The defenses that actually stop it
Breached-password screening is the cheapest defense that works: check new and existing passwords against a breached list like Have I Been Pwned, which holds more than 613 million breached credentials, and force a reset on any match. Per-account and per-device rate limits are the second layer, because they turn a million-attempt attack into a thousand-attempt attack.
Step-up verification is the third: require a second factor when the account changes an address or a payment method, not just at login, because that is where the theft happens. And passkeys are the endgame: FIDO's data shows zero confirmed credential-phishing takeovers in measured passkey deployments, because there is no password to steal and replay. The password is the vulnerability. Removing it removes the attack.
Keep reading
Related guides on this site: how BIN attacks walk sequential card numbers how card testing probes a checkout with small charges triangulation fraud through a fake storefront More from Bot Defense For Insurance.
Frequently asked questions
What is credential stuffing?
Credential stuffing replays username and password pairs stolen in other breaches against your store, using automated tools. It works because people reuse passwords across sites, so a pair breached elsewhere often works on your store too.
How is account takeover different from a password breach?
A password breach exposes the password. Account takeover is what happens next: the attacker uses the exposed password to get into a real customer account, then changes the address and places orders with the stored payment method.
What percentage of breaches start with stolen credentials?
Verizon's 2025 breach report found 22 percent of breaches began with compromised credentials. Credential stuffing makes up a median of 19 percent of authentication attempts on retail sites.
How do I protect my account from takeover?
Use a unique password, turn on two-factor authentication, and switch to passkeys where offered. Stores should screen passwords against breached lists, rate-limit logins per account and device, and require step-up verification for address and payment changes.