Most attacks on accounts get described as somebody breaking in. This one is closer to somebody arriving with a key ring collected from a decade of other people's break-ins and trying every key on your door, thousands of times a minute, from addresses that look like ordinary customers. Your password's length and complexity do not affect the outcome. One thing does, and it is whether you used that password anywhere else.
What Is Credential Stuffing?
OWASP defines it as the automated injection of stolen username and password pairs into website login forms, in order to fraudulently gain access to user accounts. The FBI's version, in a 2020 notification to the financial sector, is shorter: a technique using automated tools and botnets to attempt authentication across online platforms with stolen credentials. It is catalogued as OAT-008 in the OWASP Automated Threat Handbook.
The word that matters in both definitions is stolen. Every other attack on a login has to produce a password: guess it, compute it, or persuade you to type it into a phishing page. Credential stuffing starts with one that has already worked somewhere. The attacker is not asking whether the password is right. They are asking where else it is right.
That changes what defends you. Complexity rules, character mixes and length are defenses against guessing, and no guessing is happening here. A twenty-four character random password leaked from a forum in 2019 opens your bank account today if you used it there too, exactly as fast as "password123" would.
How a Credential Stuffing Attack Works
The supply chain behind one of these attacks is more organized than most people expect, and the FBI documented it in detail in a 2022 notification.
- A site is breachedUsernames and passwords leave one service and reach a criminal marketplace
- The list is packagedCleaned, deduplicated and sold as a combo list of email and password pairs
- A config is loadedA file telling the tool which site to hit, how to form the request, and how to tell a success from a failure
- Logins are replayedThrough residential proxies, so the attempts arrive looking like ordinary customers on home connections
- A reused password matchesA small fraction hit. At this volume a small fraction is thousands of accounts
- The account is taken overStored cards spent, loyalty points drained, funds transferred, or the account resold
- A second factor breaks itA correct password alone is not enough, so the match is worth nothing
Two of those steps have proper names you will meet in any serious write-up. A combo list is the file of username and password pairs, taken from a breach or bought on a marketplace. A config is the instruction file pointing the tool at one particular site: the address to target, how to shape the login request, whether proxies are needed, and how to recognize a successful login. Configs for popular sites are traded like any other product.
The proxies matter too. Attempts get routed through residential proxies, which sit on ordinary home internet connections and are far less likely to be flagged than data center addresses. Mobile applications are a favorite target because, as the FBI notes, they often carry weaker protections than the website and permit a higher rate of login attempts, measured in checks per minute.
This is a market rather than a hobby. Investigating two websites selling cracked accounts, the FBI and the Australian Federal Police found more than 300,000 unique credential sets obtained through credential stuffing, over 175,000 registered customers, and more than $400,000 in sales.
Why Credential Stuffing Works
It works for one reason, and the reason is measurable. In a 2020 survey cited in the FBI's financial sector notification, nearly 60 percent of respondents reported using one or more passwords across multiple accounts.
The rest is arithmetic. Any single attempt almost certainly fails, and at enough attempts per minute the failures stop mattering: a fraction of a percent of a few million pairs is still thousands of working accounts, holding stored payment cards, loyalty balances, order histories and, at a bank, money. The FBI has counted nearly 50,000 account compromises reported by US financial institutions since 2017 from this attack alone.
The other half of the answer is that the credentials keep arriving. Every breach that leaks a login adds to the pool, whether it was taken by exploiting a flaw, by talking somebody into handing it over, or from a database left open. Stolen credentials were the most common way into an organization for eighteen straight years, until the 2026 Verizon Data Breach Investigations Report recorded vulnerability exploitation edging past them at 31 percent of breaches.
Credential Stuffing vs Brute Force vs Password Spraying
These three get used interchangeably and they are three different attacks with three different defenses.
| Attack | What the attacker starts with | What it targets | What stops it |
|---|---|---|---|
| Brute force | Nothing. Characters generated or drawn from a wordlist | One account, many password attempts | Password length and randomness, rate limiting, lockouts |
| Password spraying | A short list of very common passwords | Many accounts, one or two attempts each, to stay under lockout thresholds | Blocking common passwords, detection across accounts |
| Credential stuffing | Real username and password pairs stolen from another site | Many accounts, one attempt each with a known-good password | Unique passwords, multi-factor authentication |
The distinction people miss is the lockout threshold. Brute force hammers one account and trips every counter you have. Spraying and stuffing both spread thin on purpose, one attempt per account, so no individual account looks unusual. Per-account lockouts therefore do almost nothing against either, and detection has to watch the whole login surface rather than one user.
How to Detect Credential Stuffing
From inside the company being attacked, the FBI names two signals that are worth writing into a monitoring rule.
The first is an unusually high number of failed logins, possibly in the millions, arriving from a diverse range of IP addresses through the account portal. The second is a higher than usual lockout rate, or an influx of customer calls about being locked out. They describe one event from two directions, and the second usually reaches the help desk before anybody reads the first.
Two more places to look. API endpoints, because between May and September 2019 as much as 75 percent of credential stuffing attacks against the financial industry targeted APIs rather than the web login, and APIs are less likely to demand a second factor. And the mobile app, protected differently from the website even though it reaches the same accounts.
How to Avoid Credential Stuffing
For an individual the whole defense is two habits, and they are the two habits every security page recommends for other reasons as well.
For a company running a login page, the mitigations the FBI recommends are concrete and mostly unglamorous.
Can a VPN Stop Credential Stuffing?
No, and the reason is worth understanding because it applies to a lot of security advice.
A VPN encrypts the connection between your device and the VPN provider and hides your IP address from the sites you visit. Credential stuffing does not touch your connection. It happens between an attacker's machine and a company's login server, using a password you typed correctly, months ago, on a site that later got breached. Your traffic is not involved, so encrypting it changes nothing.
The confusion is understandable, since attackers do use proxies and VPN-like services themselves, on their side, to spread their attempts across addresses. That is the same technology aimed the other way. A VPN is a reasonable tool for privacy on untrusted networks, and it belongs in a sensible picture of the threats a small company actually meets. It is not a control for account takeover. Unique passwords and a second factor are.
Examples of Credential Stuffing Attacks
The public cases tend to be consumer brands, because that is where the accounts are. The FBI's 2022 notification says media companies and restaurant groups are considered lucrative targets specifically because they hold large numbers of customer accounts that users treat as unimportant, which is exactly why the passwords on them get reused.
Its 2020 notification is more concrete. Between June and November 2019, a small group of criminals compromised more than 4,000 online banking accounts at a financial services institution and three of its clients, then used bill payment services to send themselves about $40,000, wired on to foreign accounts. Researchers examining one of those firms found more than 1,500 email addresses and 6,000 passwords exposed across more than 80 separate data breaches, some belonging to leadership and system administrators.
Key takeaways
- Credential stuffing replays real username and password pairs stolen from one site against other sites. It does not guess anything.
- Password strength is irrelevant to it. Uniqueness is the only property of a password that matters here.
- It works because roughly six in ten people reuse passwords and the lists run to billions of pairs, so a failure rate above 99 percent is still profitable.
- It is not brute force. Attempts spread one per account on purpose, so per-account lockouts miss it and detection has to watch the whole login surface.
- Multi-factor authentication is the primary defense, and it has to cover APIs and mobile apps as well as the web login.
- For a company, the best moves are testing your own users against public breach lists, uninformative login errors, and current NIST rules instead of forced rotation.
Common questions
What is credential stuffing in simple terms?
Somebody takes email addresses and passwords stolen from one website and tries them on other websites, automatically and very fast, hoping people used the same password twice. Where they did, the attacker gets in without breaking anything.
How do you avoid credential stuffing?
Use a different password on every site, which makes replaying one impossible, and turn on multi-factor authentication so a correct password alone is not enough. A password manager makes the first practical. Those two steps end the attack for an individual.
What is the difference between password spraying and credential stuffing?
Password spraying tries a few very common passwords against many accounts, hoping somebody chose one of them. Credential stuffing tries known-correct passwords stolen from another site. Spraying is guessing spread thin. Stuffing is not guessing at all.
Can a VPN stop credential stuffing?
No. A VPN protects the connection between your device and a website. This attack takes place between an attacker and a company's login server, using a password that leaked from a different site entirely. Your connection is not part of it.
Can you give me an example of credential theft?
A shopping site is breached and its login database copied. The pairs are cleaned up and sold as a combo list. Months later somebody replays that list against a bank, and the customers who used their shopping password there lose their accounts.
How do you detect a credential stuffing attack?
From the company side, the FBI names two signals: a large spike in failed logins arriving from a wide spread of IP addresses, and a jump in account lockouts or customer calls about being locked out. Login volume on APIs and mobile apps is worth watching separately.
Does a strong password stop credential stuffing?
Not on its own. Length and complexity defend against guessing, and this attack does not guess. A twenty-character random password you also used on a site that got breached is exactly as exposed as a weak one. Uniqueness is what protects you.
Does multi-factor authentication stop credential stuffing?
Largely, yes, which is why OWASP names it the primary counter-measure. A matched password stops being enough to log in. Codes sent by text can be intercepted in targeted attacks, so prefer an authenticator app, a passkey or a hardware key where they are offered.
How do attackers get the passwords in the first place?
From data breaches at other companies, from malware that harvests saved browser passwords, and from phishing pages that capture what people type. All three end in the same place: pairs traded on marketplaces and assembled into combo lists.
How do I know if my password is in a breach list?
Check it against Have I Been Pwned's Pwned Passwords service, which is free and does not receive your password: it is hashed in your browser and only the first five characters of that hash are sent. Anything it reports as seen should be changed everywhere you used it.
On this page
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.