Account security
What Is Credential Stuffing?
Credential stuffing is the automated reuse of leaked logins on other sites. This guide explains the idea in plain English and the defenses that actually help.
How stuffing differs from guessing
Guessing invents passwords. Stuffing replays passwords that already worked somewhere else. You will not see a person typing. You may see a burst of failed sign-ins, then one success on a site you rarely use. Or you may see nothing until a shopping order you did not place. The FTC has warned that reused passwords can turn a breach at one company into trouble at another. That sentence is the consumer version of what is credential stuffing. It is not the same as someone breaking the bank’s encryption. The bank’s login form is working as designed. The secret is simply not secret anymore.
Why a “small” leak still matters
Stuffing does not need a famous headline. An old forum, a forgotten store, or a vendor you used once can supply the pair. If that pair is also your email password, the rest of your resets sit behind the same door. CISA’s household guidance keeps returning to unique passwords and multifactor authentication for this reason. A unique secret stops the replay. A second factor stops many of the remaining tries. A password manager is how most people make uniqueness realistic. The FTC lists managers and browser generators as tools for people who cannot remember random strings.
What stuffing looks like in your own accounts
Watch official activity pages, not a stranger’s “we stopped the attack” email.
One odd city label is not proof. A new device plus a reset you did not start is enough to act on the official site.
- Sign-ins from devices you do not own
- Password-reset mail you did not request
- Orders, address changes, or gift-card drains
- New forwarding rules in email
- A site that suddenly rejects the password you thought was current, after you rule out a typo
How to break the chain
If money moved, call the bank using the number on the card. If new credit appeared, use IdentityTheft.gov. Stuffing is an account problem that can become an identity problem.
- Treat the reused phrase as burned. Do not change one letter and keep it.
- Replace it first on email, then on the account that owns your phone, then on banks and tax logins.
- Turn on MFA or a passkey. Prefer an authenticator app, passkey, or security key over SMS when the service offers it.
- Sign out other sessions.
- Store the new secrets in a manager.
- Close dead accounts through official settings so the old pair has fewer doors left.
What not to do
No consumer tool can promise that every copy of an old password is gone. You can still make the pair useless. Understanding what is credential stuffing is useful once. Making every important password unique is what keeps the next list from working.
- Do not paste the password into a site that promises to “see where it was stuffed.”
- Do not download leak files to test them yourself.
- Do not pay a caller who says they can delete the pair from every database.
- Do not assume a clean exposure check means reuse is safe. Checks are incomplete. Uniqueness is not.
Practical checklist
- Assume reused passwords will be tried elsewhere.
- Change email first.
- Unique random passwords, not a themed series.
- MFA or passkeys on email and money accounts.
- Review sessions after each change.
- Close unused accounts.
- Watch orders and credit reports if identity data may also be involved.
- Report confirmed fraud at ReportFraud.ftc.gov or IdentityTheft.gov.
Frequently asked questions
Is credential stuffing the same as a brute-force attack?
Not exactly. Brute force guesses. Stuffing replays known pairs from other sites.
Does MFA stop stuffing?
It stops many attempts if you do not approve a prompt you did not start. Unique passwords still matter.
If I never reuse passwords, am I safe from stuffing?
You are safe from this specific replay. You can still be phished or hit by a leak at a single site. Keep MFA on.
What should I do first?
Use the official account or service website, change affected credentials, review recent activity, and enable multifactor authentication where available.
Can a clean check guarantee that I am safe?
No. A clean result only means the available sources did not show a match. Continue using unique credentials and account security alerts.
Should I enter my password into a checker?
No. Use an identifier such as an email address or username, and never share a password or authentication code with an untrusted checker.
Sources
This guide is reviewed against official guidance. External pages may be updated by their respective owners.