What Is Credential Stuffing?

Credential stuffing is the automated testing of username and password pairs stolen from one service against many others. It is not guessing — the credentials are known to be real somewhere, and the attack simply looks for where else they work.

It exists entirely because people reuse passwords. Success rates per attempt are low and the volume is enormous, which makes the economics work comfortably.

How it differs from guessing

A brute force attack tries many passwords against an account. This tries one known password against many accounts, which means per-account lockout thresholds are never reached.

That distinction matters for defence: the controls that address guessing are largely irrelevant here, and the controls that work are about the credential itself and about the traffic pattern.

The operational shape of an attack

Attackers use large combination lists aggregated from many breaches, automated tooling that handles login flows and challenges, and large pools of residential proxy addresses so that requests do not concentrate on any one source.

Successful pairs are validated and then sold or used. The distribution across addresses is what defeats simple rate limiting, and it is why detection has to look at patterns rather than at sources.

The defences that actually work

Breached password checking at the point the password is chosen, which removes the credential the attack depends on. This is the single most effective measure available.

Multi-factor authentication, which makes a valid password insufficient. Behavioural detection on the login flow — velocity, failure ratios, address diversity, absence of normal browser behaviour. And challenges that escalate with suspicion rather than blocking outright.

Detecting it in your own logs

The signature is a high volume of authentication attempts with a low success rate, spread across many accounts and many source addresses, frequently with identical client characteristics.

A sudden change in the ratio of failed to successful logins is the simplest reliable indicator, and it can be alerted on with data most organisations already collect and never examine.

Responding to a successful campaign

Identify which accounts were accessed, not merely which were attempted. Force password resets for those, revoke active sessions, and check for the persistence that follows account takeover — changed recovery details, added authentication factors, new forwarding rules.

Notification obligations may apply, since unauthorised access to personal data generally qualifies regardless of how the credential was obtained.

On customer-facing services the impact is commercial

Account takeover on a consumer service produces fraud, stored payment method abuse, loyalty point theft and support cost, alongside the privacy exposure. The volume also degrades service, since a large campaign is indistinguishable from a load event.

The measures that help there differ slightly from internal ones: device-based risk signals, challenges that escalate rather than block, and monitoring for successful logins that immediately change recovery details — which is the reliable signature of takeover rather than of a legitimate return.

Where to start

Enable breached-password checking wherever your platform supports it, and alert on a change in your failed-to-successful login ratio. Both are cheap and both address this directly.

See password policy. GuardsArm delivers managed security.