Act fast to stay ahead of fraudsters

Credential stuffing is a middle step in a multi-faceted process that sees consumer login credentials go from being compromised to being monetized. Credentials can be compromised through a data breach, captured via keystroke logger malware, or a consumer falling for a phishing attack. Cybercriminals then use credential stuffing to identify the compromised username/password pairs that are valid on other sites. The compromised credential pairs are often sold on the dark web to other cybercriminals who use the data to make fraudulent purchases, steal gift cards or reward point balances, scrape personally identifiable information (PII), ATO and so on...

The reality is most companies only become aware that an account is compromised after a bad actor commits fraud or steals data. In this case the consumer isn't going to be happy with the outcome, or the experience of changing their credentials. Often they’ll blame the company even though they most likely hold some blame for the compromise. While most consumers will return to a solid brand company, they typically will shop somewhere else for a while. The company will likely lose some future business, reducing the lifetime value of the customer. Some consumers won't return to a company after they learn their account was hacked.

Early detection and remediation of compromised credentials can increase lifetime value of a customer while reducing loss. When done right, account protection has minimal impact on the customer experience and maintains the confidence and trust of customers.

24 hours is all it takes a sophisticated fraudster organization to steal, test, and put compromised data out on the dark web markets for sale. Experienced criminals have these steps optimized so they can maximize the value of the data they have acquired. - Don Bush, myNetWatchman

In a recent blog post, we discussed the trade-offs between approaches to managing account takeover (ATO) risk that rely more on prevention versus remediation. Early detection of compromised credentials are presented as an example of prevention, but emphasis should be placed on early detection, which reduces risk and screening costs at subsequent events like a transaction. The challenge: how quickly compromised credentials can be detected. This Forbes article recommends real-time monitoring and detection tools as a best practice. But how is this done? Here’s how we take on this problem.

Our Solution

Our unique data and web insights allow us to see credential stuffing attacks in action across 1.5 million web domains each month, adding on average 10 million new compromised credential pairs every day to our proprietary data repository of over 35 billion exposed credential pairs.

myNetWatchman’s Web Monitoring service continuously monitors an organization’s domains and/or email addresses, detecting credential stuffing attacks and compromised credentials, and sending you the signals you need to know about the attacks and what accounts were compromised.

Our AllCreds service takes early detection further. When you include a check with AllCreds when your customer presents a credential (e.g., login or account creation), you’ll know if that credential was ever compromised anywhere, whether a bad actor was targeting your systems or not.

Alerting a company's fraud prevention system of compromised credentials at the account login process or email usage rather than discovering a problem at the fraudulent transactions saves time, money and future losses. The time between a credential stuffing attack and fraudulent purchases can be your opportunity to act, even if it is only 24 hours!