Breached Password Detection

What it is

Stuffing works because people reuse passwords, and breach corpora tie those passwords to email addresses. Breached-password detection removes the reused credential before an attacker can use it. There are three checks:

1. At creation and change: blocklist screening. Reject passwords found in breach corpora, dictionary words, and context-specific terms such as the service name or username. NIST SP 800-63B-4 requires verifiers to do this and to tell the user why a password was rejected.
2. At login: exposure check. Check whether the submitted password, or the email-and-password pair, appears in breach data. If it does, the login is high-risk even when it succeeds: require step-up and force a reset. Combine it with Login Anomalies (new device, unusual network) to decide how hard to step up.
3. Proactive: monitoring. Ingest new breach and infostealer exposure data (External Intelligence Feeds) and act on matching accounts before any login attempt. That might mean a forced reset, MFA enrollment, or added monitoring of payouts.

Privacy-preserving lookups (k-anonymity range queries over hash prefixes) let services check exposure without sending the password, or even its full hash, to a third party.

What it stops (and what it doesn't)

• Stops: reuse of credentials already public; weak, common passwords that spraying would guess.
• Partially stops: large stuffing waves, by retiring the reused credentials. You will still see the attempts, but fewer succeed.
• Doesn't stop:
  • Phishing-captured and freshly stolen credentials
  • Session-token theft, which needs no password
  • Insider misuse
  • Any attack after a valid login, where Risk-Based Authentication and Step-Up at the transaction is the backstop

Design considerations

• Screen at every password-setting event, including support-assisted resets and admin tools.
• Treat an exposed password at login as a risk signal rather than a hard block. The real customer may be logging in with a reused password. Let them in, with step-up, then force a reset. Pass "credential exposed" into Real-Time Transaction Risk Scoring so a payout in the same session gets extra scrutiny.
• Prioritize accounts that hold value. When a large corpus drops, rank matched accounts by balance, payout-destination recency and lack of MFA. Reset or step up the top of the list first.
• Follow NIST on password rules. That means no composition rules, no forced periodic rotation (only when there is evidence of compromise), and a long minimum length for single-factor passwords. Composition rules push customers toward predictable patterns that are already on blocklists.
• Don't let detection become an oracle. Screening responses shouldn't let an attacker test whether a password belongs to a particular account, so messages should describe the password's quality and say nothing about the account.
• Handle password data carefully. Never store or log plaintext passwords during checks. Use well-reviewed hash-prefix protocols or local corpora.
• Plan to replace passwords over the long term. Breach screening is a patch for a factor you should be retiring (Passkeys and Phishing-Resistant Authentication).

Industry lens. Rewards and cashback apps are heavily hit by stuffing because small balances are easy to convert and account security is often lighter. Exposure screening plus a cash-out step-up is cheap and effective there. Brokerages and neobanks should pair exposure flags with payout-destination cooling-off.

Implementation path

Customer friction and trade-offs

• Rejections at creation cost very little if the message explains why ("this password has appeared in a data breach").
• Forced resets at login cause some abandonment and support volume. Target them by risk and value, and pair them with MFA enrollment prompts.
• Too-aggressive exposure blocks at login lock out genuine customers and drive support contacts, which raises social-engineering exposure.

Measuring effectiveness

• Exposed-credential share: the percentage of active, value-holding accounts whose current password appears in known breach data. It should trend down.
• Stuffing success rate: successful logins per attempt during attack waves, before and after the control.
• ATO by credential status: confirmed ATO losses where the password was known-exposed at the time. This should fall sharply.
• Remediation completion: the share of flagged accounts that reset or enrolled MFA within N days.

Common failure modes

• Partial coverage: screening at sign-up only, never at login or in proactive monitoring.
• Unscreened back doors: support and admin resets skip screening.
• Composition-rule theater: keeping composition and rotation rules that make passwords more predictable.
• Lost signal: the exposure flag isn't passed to transaction risk, so the stuffed session cashes out anyway.
• Unsafe implementation: logging plaintext or full hashes during checks.

Regulatory and policy notes

• NIST SP 800-63B-4 §3.1.1:
  • Verifiers must compare passwords against a blocklist of commonly used, expected or compromised values.
  • Composition rules are not allowed; forced periodic changes only on evidence of compromise.
  • Minimum length is 15 characters for single-factor passwords and 8 when the password is used with another factor.
• FFIEC 2021. Treats single-factor, password-based authentication as weak and expects layered controls.
• Privacy. Using third-party breach data is generally permitted for security purposes. Document the legal basis and retention.

Mechanisms addressed

• Credential Stuffing
• Account Takeover (ATO)
• Loyalty and Rewards Redemption Fraud driven by stuffed accounts
• Partial: Session Hijacking and Infostealers (when proactive monitoring catches exposure data)

Related controls

• Multi-Factor Authentication (MFA)
• Passkeys and Phishing-Resistant Authentication
• Rate Limiting and Throttling
• Bot Management and CAPTCHA
• Risk-Based Authentication and Step-Up
• Playbook: Playbook - Credential Stuffing Response Members

Sources and further reading

• NIST SP 800-63B-4 §3.1.1 Passwords: blocklist requirement, no composition rules, rotation only on compromise, 15/8-character minimums.
• NIST SP 800-63-4 overview: Revision 4 finalized 2025; supersedes 800-63-3.
• Federal Reserve SR 21-14 (FFIEC Authentication and Access): replaces 2005/2011 guidance; layered security.