You could have a very long, very complex password and still lose your account, if you used it somewhere else. This guide is part of our section on data breaches and hacked accounts.
How credential stuffing works
- A website is breached, and its logins leak.
- Criminals buy or download those lists, which can hold millions of pairs of email and password.
- Bots try each pair on banks, shops, email, streaming and gaming sites.
- A small share work, because people reuse passwords.
- Working logins are drained or resold.
A low success rate is enough, since the attack is cheap and automated.
Why it is so effective
The attacker does not need to crack anything, and the login attempts look normal. Bots use many IP addresses and try only one or two guesses per account, so they do not set off lockouts.
What it looks like to you
- Login alert emails from a place you have never been.
- Password reset messages you did not ask for.
- Orders or loyalty points that you do not recognize.
- Being suddenly logged out of an account.
- Changes to your saved address or payment card.
If you see these, go to signs your account has been hacked.
How to stop it
| Defense | Effect |
|---|---|
| A unique password for every site | Stops it entirely |
| Password manager | Makes unique passwords practical |
| Two-factor login | Blocks most attempts, even with a working password |
| Passkeys | Removes the password altogether |
| Leak checks | Shows which passwords to replace |
Why variations do not work
Changing Summer2024! to Summer2025! or adding the site's name does not help much. Attackers see the pattern in leaked lists and try the obvious changes automatically. Each password needs to be random.