Credential stuffing is the most mechanically simple attack in wide use: take username and password pairs exposed elsewhere, try them automatically across many services, and collect the accounts where the same combination still works. Success rates per attempt are low; the volume makes it profitable.

Why it works so well

Password reuse is near-universal because remembering unique credentials is genuinely impractical without tooling. Attackers know this, and they also know the variations people use — appending a number, a year, or a site name. Modern stuffing tools generate these permutations automatically, so a "different" password that is your old one plus a digit provides almost no protection.

What it looks like from the victim side

  • Login notifications from locations you do not recognise.
  • Password reset emails you did not request, as attackers work through your accounts.
  • Small unauthorised purchases testing whether payment methods work.
  • Loyalty points, account credit, or stored value disappearing — frequently targeted because it is easier to liquidate than card fraud.

The fix for individuals

A password manager with a unique generated password per site. This converts a breach at any one service into a non-event everywhere else. Add phishing-resistant multi-factor authentication on email and financial accounts, since email is the reset path for everything else.

The fix for site owners

  • Rate limit login attempts per account and per address, and slow repeated failures.
  • Check submitted passwords against known-breached lists at registration and reset, rejecting exposed ones.
  • Alert users to logins from new devices and locations.
  • Offer and encourage passkeys, which are immune to this attack entirely.
  • Never reveal whether a username exists through differing error messages or response times.

What not to do

Forced periodic password rotation without cause is now discouraged by most guidance, because it produces predictable incremental changes and encourages writing passwords down. Rotate on evidence of compromise, and spend the effort on uniqueness and stronger factors instead.