Credential stuffing in 2025: why passwords still fail

At a glance

What this is: This article explains why credential stuffing remains effective in 2025 and argues that adaptive MFA, behavioural signals, and passkeys are the controls that change the outcome.

Why it matters: It matters because IAM teams need controls that break reuse-based account takeover without turning every legitimate login into a friction point.

Context

Credential stuffing is an automated account takeover pattern built on reuse, scale, and low-friction abuse of login systems. The core weakness is not just stolen credentials, but the assumption that a login flow can judge risk from a single request in isolation.

For identity teams, this is a human IAM and customer access problem as much as it is an authentication problem. Static MFA, rate limiting, and IP reputation can slow some attacks, but they do not remove the attacker advantage when credentials already work and the source activity is distributed.

Key questions

Q: What fails when credential stuffing is handled with static login rules?

A: Static login rules fail because credential stuffing is designed to look like normal low-volume access across many accounts and many IPs. The result is that rate limits and simple lockouts catch only a fraction of the traffic, while stolen credentials that still work are allowed through. Defenders need risk-based decisioning, not just volume thresholds.

Q: Why do password reuse and near reuse create such high account takeover risk?

A: Password reuse turns one breach into many because attackers often test exposed credentials across multiple services. Near reuse is almost as dangerous, since users commonly make small edits that preserve the original structure. If a password has appeared in a data breach, it should be treated as compromised and replaced everywhere it was used, not just at the affected account.

Q: How do security teams know adaptive MFA is actually reducing credential stuffing?

A: They should look for fewer successful logins following unusual risk signals, fewer account recoveries after suspicious sign-ins, and lower fraud or support volume tied to authentication abuse. If adaptive MFA is working, normal users should pass quickly while anomalous attempts are forced into stronger verification or blocked before session creation.

Q: Should organisations replace passwords everywhere with passkeys immediately?

A: No. Organisations should prioritise high-volume, high-friction consumer flows first, then expand where device support and recovery controls are mature. Immediate replacement can create support gaps if the fallback model is weak. A staged rollout lets teams verify assurance, usability, and operational readiness before eliminating passwords more broadly.

Technical breakdown

Why credential stuffing defeats rate limiting

Credential stuffing differs from brute force because each username and password pair is typically tried once or a few times, often across many sites, rather than repeatedly against one account. That makes per-IP throttles and simple lockout rules much less effective. Attackers also use proxy networks and rotating infrastructure to make requests appear normal. The authentication event itself looks legitimate unless the system can correlate device, behaviour, and session context across attempts.

Practical implication: move beyond request-count controls and inspect login context, not just login volume.

How adaptive MFA changes the decision point

Adaptive MFA evaluates risk at the moment of sign-in, using factors such as device, location, velocity, history, and behavioural anomalies to decide whether additional verification is needed. This is different from static MFA, which applies the same challenge regardless of context and creates fatigue. Push-based or step-up challenges work best when they are reserved for unusual patterns such as a new country, impossible travel, or a success after repeated failures.

Practical implication: trigger stronger verification only when risk signals justify it, so normal users do not get conditioned to ignore prompts.

Why passkeys break the reuse model

Passkeys replace shared secrets with cryptographic key pairs bound to a specific domain. The server stores only the public key, so there is no password database to steal and no reusable secret for attackers to replay elsewhere. That changes the attack economics because credential stuffing depends on one compromised secret working across many services. If the secret cannot be reused, the attack loses its primary advantage.

Practical implication: treat passkeys as a structural reduction in account takeover exposure, not as a cosmetic login improvement.

Threat narrative

Attacker objective: The attacker wants to turn reused credentials into valid sessions across consumer or employee accounts and monetise the resulting access.

1. Entry occurs when attackers feed breached username and password pairs into login portals at scale, often using automation and rotating infrastructure to avoid obvious patterns.
2. Credential access is achieved when a small percentage of reused credentials still authenticate successfully, creating valid sessions without needing a password reset or exploit chain.
3. Impact follows as attackers take over accounts for fraud, data access, support cost, or further abuse, while defenders see only low-volume anomalies spread across many systems.

Breaches seen in the wild

• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static login flows are the real vulnerability, not passwords alone. Credential stuffing succeeds because authentication systems still assume that a login attempt can be judged in isolation. Once attacker infrastructure spreads attempts across many IPs and many accounts, that assumption collapses. The practitioner lesson is that identity assurance has to move from the login event to the context around it.

Credential stuffing is now an identity orchestration problem. The attack blends breached secrets, automation, behavioural mimicry, and friction management into one chain. That means the control boundary is no longer just authentication strength; it is the orchestration of risk signals, challenge timing, and session establishment. For identity programmes, the question is how much of access decisioning can still rely on static policy.

Passkeys reduce attack surface because they remove shared secrets from the model. When a service no longer accepts reusable passwords, credential stuffing loses its core payload. That is a governance shift, not just an authentication upgrade, because it changes the inventory of secrets that identity teams must protect and recover. Practitioners should treat passkey adoption as a structural control against account takeover.

Adaptive verification is becoming the baseline for customer and workforce access. Teams that still challenge every login the same way create both user fatigue and attacker opportunity. The stronger model is risk-based, context-aware, and selective about when to escalate. The implication for IAM leads is that authentication policy now has to be tuned as a living control surface, not a static gate.

Reusable credential trust debt: Password ecosystems continue to accumulate risk because every breached reuse event extends the life of secrets that should already have been retired. That debt is paid when the programme shifts to non-reusable credentials, adaptive challenge, and session-level assurance. Practitioners should measure how much of their access estate still depends on shared secrets.

What this signals

Adaptive authentication is now a control design issue, not a feature choice. Teams that treat MFA as a fixed checkpoint will keep fighting the same attacker advantage, because credential stuffing is built to exploit predictable policy. The better model is a dynamic challenge layer that reacts to risk signals already present in the session.

Passkeys change the governance question from secret protection to credential recovery. Once reusable passwords disappear from the front door, the programme has to manage device binding, enrolment, and recovery flows with far more discipline. That is the operational trade-off security leaders should plan for now.

For practitioners

• Implement adaptive step-up policies Use device, location, velocity, and historical access patterns to trigger additional verification only when sign-in risk changes materially.
• Prioritise passkey rollout for high-value accounts Start with accounts that create the greatest fraud or data exposure if taken over, then expand to broader user populations once recovery and enrolment flows are stable.
• Reduce reliance on static login signals Supplement IP reputation and rate limiting with behavioural and session signals so distributed attacks are visible even when each attempt is low frequency.
• Measure account takeover pressure by outcome, not attempt count Track successful logins after repeated failures, unusual-country approvals, help desk resets, and post-authentication fraud to see where credential stuffing is still landing.

Key takeaways

• Credential stuffing remains effective because attackers can turn breached passwords into valid sessions even when each individual attempt looks low risk.
• The control gap is not a lack of MFA alone, but a reliance on static login rules that do not respond to context or behaviour.
• Passkeys and adaptive MFA shift the defensive model away from reusable secrets and toward risk-based access decisions.

Key terms

• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Adaptive MFA: A multi-factor authentication pattern that changes the challenge based on user context, risk, and policy. It reduces unnecessary friction by avoiding one-size-fits-all prompts, while still increasing assurance when a session, device, or location looks unusual.
• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Behavioral Biometrics: Behavioral biometrics uses patterns such as typing rhythm, swipe style, device handling, and session timing to infer whether the same user is still present. In practice, it supports continuous verification, but it also demands careful tuning because legitimate behavior can change with context.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.