# How do credential lists from old breaches keep powering retail account takeovers? | BondProof

Source: https://bondproof.com/blog/2026-10-29-credential-lists-account-takeover-retail.html

[Home](../index.md) / [Blog](index.md)


October 29, 2026 - BondProof

**Short answer:** A credential list is just email and password pairs from past breaches, and people reuse passwords. Attackers test the pairs in bulk with automated tools, keep the ones that log in, and drain the value inside: stored cards, loyalty points, and refund routes. Breached password screening and step up checks on risky logins cut the success rate hard.

## Old breaches are a standing inventory

Every major breach adds pairs to a pool that gets merged, deduplicated, and resold. The trade calls the merged files combolists. A pair from a breach years ago still works today if the owner never changed that password, and password reuse across sites remains the norm rather than the exception.

Testing the pairs is called credential stuffing. The tool loads the list, rotates through residential proxies so each attempt looks like a different household, and mimics the timing and headers of a normal login. Success rates per list are low, often well under one attempt in a hundred, but the lists run to millions of pairs and the testing costs almost nothing.

The output is a validated list: accounts confirmed live, sorted by what is inside them. That list, not the raw breach data, is the valuable product.

## Why retail accounts are worth the effort

A retail account holds stored payment methods, saved addresses, order history that answers security questions, and loyalty balances that convert to goods. It also offers a quiet monetisation route: order to a reshipping address, or claim a refund for an item that arrived fine.

Retail logins are also softer targets than banking logins. Fewer step up challenges, longer sessions, and customers who treat a store account as low stakes, even when a card sits behind it.

## Defences, in the order they pay off

Screen passwords against known breached pairs at signup and at password change, and force a reset when a customer current password turns up in a new breach corpus. This attacks the inventory directly: a pair that no longer matches a live password is worthless.

Add step up verification when the login context changes sharply: new device, new country, or a login followed within minutes by an address change or a high value order. Attackers can fake one signal cheaply. Faking a consistent history is slower and dearer.

Rate limiting and CAPTCHA alone disappoint. Proxies defeat per address limits, and solving services defeat challenges for fractions of a cent each. They raise the cost slightly; they do not change the economics. State that plainly in any internal proposal, because budgets spent there are budgets not spent on screening and step up checks.

Watch for the testing itself. A spike in failed logins across many accounts, with realistic user agents and residential addresses, is a stuffing run in progress. Locking the targeted accounts quietly and forcing resets beats watching the run finish.

## The customer conversation nobody wants to have

When a takeover happens, the customer hears that their password was the problem, which is true and useless. The useful message names the fix: a unique password for the account, a password manager to make that realistic, and two factor where the store offers it. Stores that send that message plainly after an incident keep more of those customers than stores that hide behind a generic security notice.

Keep reading: [How do bots abuse price match guarantees to drain retail margins?](https://bondproof.com/blog/2026-10-29-price-match-abuse-bots.md), [Shift handover notes: passing cash and issues cleanly between staff](https://bondproof.com/blog/2026-10-29-shift-handover-notes-cash-issues.md), and [Damaged stock write offs: recording them so counts stay true](https://bondproof.com/blog/2026-10-29-damaged-stock-write-offs-recording-counts.md) cover the nearby cases in this series.

## Frequently asked questions

### What is a combolist?

A combolist is a merged file of email and password pairs collected from many breaches, cleaned and deduplicated for automated testing. Attackers buy or trade them, run them against a target site, and keep the pairs that log in successfully.

### Why do attackers use residential proxies for credential stuffing?

Because login defences block traffic from known data centre addresses and rate limit by IP. Residential proxies route attempts through real household connections, so each try looks like a normal customer signing in from home.

### Does CAPTCHA stop credential stuffing?

Not on its own. Solving services and machine vision tools answer challenges cheaply and at scale. CAPTCHA slows a run and adds a small cost per attempt, but breached password screening and step up verification are what actually cut takeover numbers.

### How can a shopper protect their retail accounts?

Use a different password for every store, ideally from a password manager, and turn on two factor authentication where it is offered. A breached password then compromises one account instead of every account that shared it.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@bondproof.com?subject=Free%20free%20bot-traffic%20audit)