Credential Stuffing: How to Avoid Being Another Victim

Peter Steven Ho
7 min readApr 25, 2024

If noticed a suspicious transaction in your bank statement for an online purchase that you didn’t make, you may be a victim of a credential stuffing scam. Find out how the scam works and how to prevent this from happening to you.

“Password Security” by Cloud Income is licensed under CC BY 2.0.

The threat actors are hard at it again, this time, it’s credential stuffing. I agree, it’s a rather odd name for a scam but according to ITonDemand, credential stuffing has already cost consumers $2.7 million annually, $1.7 million in downtime and $1.6 million in IT expenses for businesses annually. It’s definitely a growing concern for authorities, and you should be equally concerned.

Credential stuffing is an insidious form of theft. Victims are often left angry and embarrassed with the realisation that they could have done more to limit their exposure. It’s usually poor password practices that have given threat actors easy access to accounts on other systems, like online stores. And once they’re in, there’s nothing to stop them from using the victim’s stored credit card to make a significant number of purchases.

Sadly, victims are oblivious to the theft until they notice a mysterious transaction on their bank statement. But by this time, the threat actors would have retreated to the shadows along with all the goods.

--

--

Peter Steven Ho

BSc (Hons), LLB. Freelance writer in Technology, Science and Travel. Come join me on a journey of discovery.