Credential stuffing is not password spraying: why the defence differs
Read the log shape before you reach for a control
Stuffing is high volume and high failure with a telling success rate: thousands of attempts from rotating addresses, most failing, a small steady share succeeding because the pairs are real passwords, just for the wrong site. Those successes from first seen devices, immediately changing email or payout details or placing a high value order, are ATO in progress, not lucky customers.
Spraying is the opposite shape: low volume per account, often one attempt per account per hour, spread across the whole customer base, with the same password tried against account after account. Per account lockouts never trigger, because no account is tried often. The pattern only exists at the population level, which is why a defence built per account cannot see it.
Controls matched to the attack
Against stuffing, check new logins against breached password corpora and force a reset when a customer's exact pair is known to be leaked. Add MFA, with authenticator apps preferred over SMS where your customers will accept it, and rate limit by account plus device signals rather than by IP alone, because residential proxies rotate the address and keep the account velocity visible. Velocity on the account is the signal the attacker cannot rotate away.
Against spraying, the levers are password policy and population analytics. Block known common and breached passwords at set and reset time, so the spray list has nothing to hit. Then alert on the population shape: one password attempted across an abnormal number of distinct accounts, failures spread thin and wide. A WAF rule tuned to per IP volume will miss a spray run through a proxy pool on purpose.
What success looks like for the attacker, and where to catch it
Both attacks monetise in the same places: stored payment methods, loyalty balances, saved addresses for reshipping, and seller payouts on dual role accounts. Put step up verification at those value actions, not only at login. A stuffed session that can browse but cannot change the email, move loyalty value, or check out on a new device without a fresh factor is a contained incident, not a loss.
Notify the customer on the signals you would want to know about: a login from a new country, a password or email change, a new payee or address. Notifications are detection outsourced to the one person who knows instantly whether it was them. Send them over a channel the attacker does not control by having changed the account email five minutes earlier. Sequence matters.
Aggressive lockouts hand the attacker a second weapon: denial of service against your real customers by triggering locks on their accounts. Prefer progressive delays, challenges, and step up checks over hard locks, and give support a fast, identity checked unlock path before you tighten anything. A defence customers experience as random lockouts will be switched off by your own business within a quarter.
Do not let the cure lock out the customer base
Measure both attacks separately in reporting: attempts, success rate, accounts confirmed taken over, value lost. A single blended bot number hides a rising spray campaign inside a falling stuffing one and tells leadership the programme is winning while accounts leak out the side.
Frequently asked questions
Which attack is more common against store accounts?
Credential stuffing, by volume, because breach pairs are cheap and reuse is widespread. Spraying is quieter and often aimed at staff, admin, and high value accounts. Most stores face stuffing weekly and spraying in slower campaigns.
Which attack is more common against store accounts?
MFA stops the login from becoming access in both cases, unless the attacker phishes a code in real time. Breached password screening blunts spraying at the password itself, and stuffing at the reused pair. Use all three layers.
Which attack is more common against store accounts?
Because spraying deliberately tries each account rarely, once or twice an hour. No single account crosses a lockout threshold. Only population level analysis, one password across many accounts, reveals the campaign.
Which attack is more common against store accounts?
Change the password to one not used anywhere else, review account changes, addresses, orders, and payout or payment details, and turn on MFA. Then check the same email and password pair on other sites, because that reuse is how the attack started.