← Fraud Database

Account takeover via credential stuffing: how it works, warning signs and what to do

Identity theft · médio

Criminals gather lists of emails and passwords from old breaches or harvested by infostealer malware and automatically test those combinations, using bots, across thousands of sites. Wherever the password was reused, they get in.

Once inside, they change recovery email and phone, buy with saved cards, redeem points, sell the account or use the email to reset passwords on other services.

The ITRC annual report counted 28 credential stuffing attacks among US data compromises in 2025.

Sinais / Signs

• Login alerts from an unknown location or device
• Recovery email or phone changed without your request
• Orders or point redemptions you did not make
• Receiving several password-reset codes
• Your email shows up in breach-alert services

Prevenção / Prevention

• Use a unique password for every service, with a password manager
• Turn on MFA, preferably an authenticator app or passkey
• Secure your main email first, since it resets every other account
• Remove saved cards from rarely used sites
• Companies: rate-limit logins, detect bots and offer passkeys

O que fazer / What to do

• Reset the password and sign out all active sessions
• Restore recovery email and phone and enable MFA
• Change that password on every other service where it was used
• Dispute purchases and notify the affected service
• If your data was used to open accounts, use IdentityTheft.gov (US)

FAQ

My password is strong. Am I still at risk?

Yes, if it was reused and leaked from any service. Strength does not protect against reuse.

How is this different from phishing?

In phishing, the victim hands over the password. In credential stuffing, it already leaked and is tested automatically.

Radar

1. 2026-06-05 — Dashlane brute-force attack obtains customers' encrypted vaults. Attackers brute-forced accounts at the password manager; the number of affected vaults was not disclosed. Source: Help Net Security
2. 2025-06-01 — Compilation of 30 infostealer datasets gathers about 16 billion logins · ~16 bi de logins. The set aggregates credentials stolen by infostealer malware; the figure comes from a secondary compilation (VoxBooster). Source: VoxBooster (compilação secundária)

• Passkeys, MFA and the end of passwords: what stops account takeover

FTC - IdentityTheft.gov · ITRC 2025 Annual Data Breach Report (PDF) · CERT.br · ANPD