Credential stuffing

Credential stuffing is when criminals take leaked emails and passwords from one site and try them on many other sites, hoping you reused them.

Credential stuffing: Credential stuffing is an attack in which stolen login pairs from one data breach are automatically tried on other websites. It works because many people use the same email and password everywhere, so a leak at a small site can open a bank or shopping account.

Leaked lists circulate widely among criminals. Software tries each pair on popular services such as email, shopping, food delivery, streaming and payment apps, thousands at a time. You may see this as an unexpected login alert, a password reset email you did not request or an order you never placed. Because it is automatic, attackers do not need to know you at all; your reused password is enough.

The fix is a different password for every account, which is easy only with a password manager. Prioritise email, banking and shopping. Add two-factor authentication so that a matching password alone does not work. Also check whether your email appears in known leaks and change any reused password right away. Check the account activity page of your email for logins from places you do not know.

Tips

• Never reuse a password across email, banking, shopping and social accounts.
• Store unique passwords in a password manager instead of remembering them.
• Use Safeavio's password-exposure check, which gives only a date and rough result, then change any reused password.

Related terms