How do account takeover bots test stolen passwords across retail sites?

Credential stuffing runs on reuse, not genius

The attack needs no vulnerability in your store. It needs a breach list from anywhere else and customers who used the same password with you. Testing millions of pairs at a low success rate still yields thousands of working logins, each attached to a real person payment methods, addresses, and loyalty balances.

Operators refine lists before they spend them: removing dead formats, prioritizing email domains and retailers that match the source breach demographics, and warming up infrastructure so the testing traffic arrives from addresses that look like ordinary shoppers.

Testing is designed to look like forgetting

A login page sees failed attempts all day from honest people mistyping. Stuffing hides inside that noise by throttling per account, rotating networks, and solving challenges through services, so no single account or address crosses a threshold that would trigger a lockout or an alert.

Success is harvested carefully too. A working login is not always used immediately. Accounts are inventoried, their stored value assessed, and the best ones sold or drained in separate operations, which separates the testing signal from the theft signal in time.

What a taken account is worth

Stored cards enable direct purchases of goods that resell cleanly. Loyalty points and gift balances convert even faster and draw less attention than card use. Accounts with a clean purchase history also pass retailer risk checks that a fresh account would fail, making the account itself a tool for further fraud.

For the owner, the damage spreads. The same password often guards email, and email guards password resets everywhere else. One retail takeover can be the first domino in a week of account recovery across a person whole digital life.

Defenses that break the economics

Screen new logins against known breach corpora and force a reset when a customer password matches a breached pair. That single check removes the exact inventory stuffing depends on, and it protects the customer even though your store was never breached.

Add risk based step up rather than blanket friction: a correct password from a new device, network, and geography earns a verification challenge, while the regular customer on their usual phone sails through. Monitor for testing shapes, many accounts tried once from shared infrastructure, not just many tries on one account.

What shoppers can do that actually helps

Unique passwords per account, stored in a password manager, end the reuse the attack feeds on, and passkeys or two factor verification protect an account even when its password leaks. The advice is old because the attack is old, and both survive on the same human habit.

Retailers should say so at the moments that matter: on the login page after a stuffed attempt wave, in the email after a forced reset, and never in language that blames the customer. The store that explains the breach came from elsewhere earns trust while it imposes the reset.

Keep reading: How do fake coupon browser extensions steal affiliate commissions and shopper data?, How do bots impersonate delivery companies in package tracking scams?, and How do bots inflate livestream shopping audiences with fake viewers? cover the nearby cases in this series.

Frequently asked questions