Credential stuffing attacks on retail accounts: borrowed passwords at machine speed

How a stuffing campaign runs

The tooling is rented, not built. An operator loads a breached list, points it at a store's login, and configures it to solve challenges and spread requests across proxy networks so no single address trips alarms. Successful logins are harvested and sold, or used directly to order goods, drain stored value, and harvest personal data from account pages.

Campaigns come in waves tied to fresh breach data and to retail calendars. A stuffing run before a major sale is not a coincidence: accounts taken over in advance sit quietly until they can be used for high value orders in the rush, when support teams and fraud review are at their busiest.

Why stores underestimate the attack

Failed logins are invisible in most reporting. A store can absorb hundreds of thousands of failed attempts in a night and notice only the successful takeovers, which look like ordinary customer fraud. Login success rates, the share of attempts that succeed, are the metric that reveals stuffing, because a healthy login page has a stable, human pattern of failures and a stuffing run bends that pattern hard.

Stores also misjudge who pays. The customer whose account is taken blames the store, not the unrelated site that leaked their password years earlier. Regulators and card networks increasingly agree with the customer: known, preventable attack patterns are the store's problem to defend.

Defences that actually blunt stuffing

Screening new passwords and logins against known breached password lists catches reuse at the moment it matters, and forcing a reset with a second factor for accounts that match breach data closes the door before the stuffing tool arrives. Rate limits need to be per account and per device fingerprint, not just per address, because proxy rotation defeats address limits alone.

Bot detection at the login page carries the main load: device signals, behaviour timing, and challenge systems that step up only when a session looks automated. The aim is to make each attempt expensive for the tool while a human shopper notices nothing. Two factor authentication for customers remains the strongest backstop, especially when required at risky moments like address or payment changes.

Responding when a wave lands

A prepared store treats a stuffing spike as an incident with a playbook: tighten login challenges, watch successful login rates by the hour, force resets on accounts with suspicious successful logins, and warn affected customers in plain language about what happened and what to change. Silence protects the attacker, who is counting on accounts staying valid for weeks.

Afterwards, the lesson goes into the metrics. Login attempts, success ratios, and challenge rates belong on a dashboard someone reviews routinely, because the next wave is a matter of timing, not possibility. Credential stuffing is not an exotic attack. It is weather, and stores dress for it or get wet.

Keep reading: Fake account creation bots: why stores drown in junk signups, API abuse bots: the attacks your storefront never sees, and How do bots abuse gift card balance check pages on store sites? cover the nearby cases in this series.

Frequently asked questions