Account takeover and credential stuffing attacks are two security threats that often go hand in hand. Both have become alarmingly prominent: a recent report found that one-fifth of account openings so far in 2019 have been fraudulent.
Credential stuffing is when criminals get access to customer login details, typically by purchasing a list based on a data breach on the dark web. They then use automated login requests to attempt to access various accounts. Since many people use the same passwords for multiple accounts, something will usually work. In an account takeover (ATO) scenario, attackers use bots to test out thousands of stolen credentials. Once they succeed at breaking into an account, they take it over and use it to perform illicit activities like theft, fraud, and data exfiltration.