The Outlier Lab

Credential Stuffing

Automated replay of username-password pairs stolen elsewhere to find accounts that reuse them, producing validated access that is later monetized through redemptions, purchases and withdrawals.

What it is

OWASP's Automated Threats taxonomy classifies credential stuffing as OAT-008: mass login attempts that test whether stolen username-password pairs work. It is distinct from OAT-007 Credential Cracking, which guesses values rather than replaying known ones. OAT-019 Account Creation is the sign-up counterpart (see Fake Account Creation (Bots)). OAT-012 Cashing Out names the monetization step that follows. Password spraying is the inverse of stuffing: a few common passwords tried across many accounts. Both show up in the same login telemetry, and both are covered here.

Stuffing is an access-validation step. It produces a list of accounts that work. The loss is booked under Account Takeover (ATO) when the monetizer acts.

Why it still works:

  • Password reuse is widespread. Verizon's 2025 DBIR analyzed infostealer logs from 14,742 compromised devices. In the median case, only 49% of a user's saved passwords across services were distinct.
  • The volume is huge and constant. Verizon's analysis of single-sign-on provider logs found credential stuffing was a median 19% of all daily authentication attempts. That rose to 25% at enterprise-sized organizations and peaked at 44% on one day.
  • It accounts for most identity attack traffic. Microsoft reports that more than 97% of identity attacks are password spray or brute force.

How it works

Diagram: Breached and harvested credential lists, Automated login attempts at scale, Validated accounts (hits), Triage by value (balance, stored cards, payout methods), Monetize: redeem, purchase, transfer, change payout, Resale of validated access

Conceptually:

  1. Source. Combined lists from old breaches, recent phishing, and infostealer logs (see Session Hijacking and Infostealers). Fresher lists hit more often.
  2. Test. Automated clients replay the pairs against login, mobile API or legacy endpoints. Traffic is spread across residential-looking networks and varied device fingerprints to look like normal users.
  3. Triage. Successful logins are checked for what they hold: balances, stored cards, linked banks, loyalty points, saved addresses.
  4. Monetize or resell. High-value hits are worked by hand. Low-value hits are drained by automation or sold (see Fraud-as-a-Service Ecosystem and Account Farming and Resale).

Transaction footprint

What sets stuffing apart in the data is the delay. The login wave is easy to spot, while the monetization blends into normal activity and often comes days or weeks later.

StageWhat you see in the dataDecision point
WaveLogin volume spike; failure rate jumps; many accounts per device or network; traffic to unusual endpointsBot management, rate limits, breached-password checks
ValidationSuccessful logins from new devices with no further activity ("check and leave")Flag the account, not just the session, for elevated risk on later activity
TriageViews of balance, rewards, payment methods or profile, with no browsingSession scoring
ControlEmail or phone change; new device enrolled; stored payout method editedContact Change Cooling-Off Periods
Cash-outReward redemption to gift card; purchase with stored card shipped to new address; payout change; small P2PStep-up at first money movement after a flagged login

Common variants

VariantWhat's differentWhere it shows up
Classic stuffingMany pairs, one try eachAll consumer logins
Password sprayingFew common passwords across many usernamesOlder user bases; enterprise portals
API and mobile stuffingTargets mobile or partner APIs with weaker bot controlsApps with legacy endpoints
Low-and-slowSpread over weeks to stay under rate limitsHigher-value targets
Stuffing plus recoveryHits trigger reset or OTP flows when passwords failPlatforms with weak recovery (Account Recovery Abuse)
Enumeration-assistedProbes whether an account exists before trying passwordsSign-up, reset and login forms with revealing errors

Where it shows up

Impact

  • Direct. Redeemed balances, goods, transfers. Usually small per account but aggregated across thousands.
  • Downstream. Card disputes on stored-card purchases, goodwill credits, and support spikes from lockouts and "who changed my email?" contacts.
  • Infrastructure. Login infrastructure costs, degraded experience for real users, distorted conversion metrics.
  • Regulatory and legal. A stuffing incident can draw scrutiny as a data-security failure even when the passwords were breached elsewhere. See Case Study - DraftKings Credential Stuffing (2022) and Privacy and Data Use in Fraud Prevention.
  • Reputation. Customers attribute the loss to "your breach" even when the passwords came from elsewhere.

Red flags

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventPasskeys and Phishing-Resistant AuthenticationRemoves the password, so there is nothing to replay
PreventBreached Password DetectionBlocks known-compromised passwords at sign-up, login and reset
PreventBot Management and CAPTCHA, Rate Limiting and ThrottlingRaises the cost per attempt, across all endpoints including APIs
DetectRisk-Based Authentication and Step-UpChallenges only the suspicious successful logins
DetectAccount-level risk flags carried forward from the waveLinks the wave to the later cash-out
RespondForced reset for validated accounts; Withdrawal and Payout ControlsContains accounts known to be validated before they're monetized
RespondFraud Incident ResponseWar-room for a live wave

Emerging variants and adversary adaptation

  • Infostealer logs are better fuel than breach lists. Logs come with fresh passwords, the URLs they belong to, and often session cookies, which raises hit rates and can skip login altogether. See Session Hijacking and Infostealers.
  • Distributed, human-like traffic. As per-IP limits and reputation checks spread, traffic moves to residential and mobile networks and to more realistic client behavior. Rate limits are best set per account, per credential and per device cluster, and combined with behavioral signals (Behavioral Biometrics).
  • Target shifts. As the web login gets hardened, attention moves to mobile APIs, partner and legacy endpoints, reset flows, and unprotected step-up fallbacks. Inventory every authentication surface.
  • Passkeys change the economics. The FIDO Alliance's 2026 survey reports that 75% of consumers have enabled passkeys on at least some accounts. Every account still holding a password remains stuffable, and attackers will concentrate on password fallbacks and on populations that never enroll.
  • Validated access is a commodity. Stuffing and monetization are increasingly done by different actors, so the time from wave to loss is variable. Treat validated-account lists as an incident artifact with a long tail.

Real-world examples

Sources and further reading