Credential stuffing

What it is

Credential stuffing is not password guessing from scratch. It reuses secrets that already leaked somewhere else — a retailer breach, an old forum dump, malware that scraped a browser. Bots then test those email-and-password pairs at banks, retailers, streaming services, and email providers.

If you reused a password, the attacker may walk right in without phishing you again. From there, account takeover, fraud orders, loyalty-point theft, or further resets can follow quickly. MFA and unique passwords are the main consumer defenses.

How it works

1. Obtain dumps — Breach lists and combo lists circulate on the dark web and criminal forums.
2. Automate — Bots try thousands of logins per hour across target sites.
3. Hit — Reused credentials succeed; MFA may still block some attempts.
4. Exploit — Steal stored cards, loyalty points, data, or pivot to email.
5. Resell — Fresh working accounts are sold to other fraudsters.
6. Unique passwords and MFA break most stuffing pipelines.

Red flags

• Login alerts for sites you rarely use
• New device or password changed emails you did not trigger
• Your email listed in breach notifications
• Orders or subscriptions you did not place
• Lockouts after repeated failed logins
• The same password still in use on multiple important sites

What to do if you’re targeted

• **Use a unique password per site** (a password manager helps) and change any reused ones now — start with email, then banking and shopping.
• **Enable MFA** — prefer authenticator apps or security keys over SMS when possible.
• **Check breach notices** (from companies or monitoring tools) and treat a reused password as burned everywhere it appeared.
• **Revoke sessions** and update recovery emails/phones on accounts that may have been hit.
• **Watch statements** for small test charges or new subscriptions.
• **Optional:** free identity scan and dark-web monitoring for newly circulating combos; identity theft insurance up to $1M is subject to policy terms.

Related terms

• Account takeover
• Data breach
• Dark web