Why do credential stuffing attacks keep working against rate limits?

Why rate limits miss distributed credential stuffing

Rate limits are usually effective only when the attack creates a clear concentration signal, such as many attempts from one IP, one device, or one account in a short window. credential stuffing is designed to avoid that shape. Attackers spread attempts across time, infrastructure, and target accounts, so the volume at any single choke point stays low even while the campaign remains large.

That is why the control can be technically “working” and still fail to stop account takeover. The attacker is not trying to win by brute force against one login form, but by finding the small percentage of reused passwords that still succeed across a population of users.

What makes credential stuffing hard to threshold

The weakness is not just the login rate, it is the assumption behind the threshold. If detection only watches per-IP or per-username bursts, it can miss low-and-slow testing that is distributed across proxies, devices, and bot nodes. Modern stuffing campaigns also adapt to locks and throttles by pacing requests, rotating targets, and reusing known good credentials only when they are likely to pass.

This is why stronger defences need more than volume-based throttles. A useful baseline is to pair rate limits with bot detection, credential reuse detection, suspicious geography or device signalling, breached-password blocking, and step-up controls for risky logins, as reflected in the Password Security and Password Manager Guide and the Customer IAM (CIAM) Guide.

When teams rely on shared passwords, weak recovery paths, or long-lived sessions, rate limits become even easier to work around. The practical issue is that the attacker only needs one valid pair per account, not a sustained flood of guesses.

What actually reduces stuffing success

The most effective response is to reduce password reuse and make automated replay harder to turn into a valid session. That means blocking known breached passwords, improving user password hygiene, adding phishing-resistant authentication where possible, and treating login risk as a signal rather than assuming all failed attempts are equally suspicious.

For operations teams, the important distinction is between suppressing noisy abuse and stopping account compromise. Rate limits help with the first problem, but they do not solve the second unless they are part of a broader access-control and fraud-detection stack. OWASP Non-Human Identity Top 10 is useful here as a reminder that abuse patterns often succeed when defenders focus on volume alone and miss the underlying access path and credential lifecycle.

Risk and Threat Considerations

Credential stuffing is attractive because it scales cheaply and blends into normal authentication noise. If the defender’s control is tuned only to per-source thresholds, an attacker can stay under the line while still testing enough reused credentials to achieve account takeover.

Failure mechanism: The attacker distributes attempts across many sources and target accounts, keeping each source below the rate-limit threshold while exploiting password reuse at scale.

Impact: Accounts are compromised without triggering obvious burst-based alarms, which can lead to fraud, data exposure, session theft, and further abuse of trusted accounts.

Practitioner Guidance

What to prioritise: Treat rate limits as one friction layer, not the primary stuffing defence. Prioritise breached-password blocking, bot-aware detection, risk-based step-up, and fast session invalidation for suspicious logins.

What to verify: Check whether your controls are measuring only source volume or also cross-source patterns, password reuse indicators, and post-login abuse. If you cannot distinguish legitimate retry behaviour from distributed automation, the control is too narrow.

Common mistake: Teams often harden the login endpoint but leave recovery flows, password reset, and session reuse as easier paths to the same account takeover outcome.

Practitioner takeaway: If attackers can spread attempts widely enough, rate limits mostly shape the attack rather than stop it, so the real objective is to make reused credentials fail safely and predictably across the entire login lifecycle.

Related resources from NHI Mgmt Group

• Why do credential stuffing attacks still succeed against consumer identity systems?
• Why do social engineering attacks keep working against modern IAM controls?
• Why do supply chain, OAuth phishing, and access token attacks keep working against mature organisations?
• What happens when cloud security teams do not keep pace with credential-stuffing attacks?