Top 10 Automated Bot Attacks: How Each Works and How to Stop It

Most automated bot attacks do not break anything: they use a login form, a sign-up page, a checkout or a text message button exactly as designed, only thousands of times faster and from thousands of addresses. That is why a web application firewall tuned for injection and cross-site scripting rarely notices them, and why the losses show up first in fraud reports, inflated SMS bills or empty shelves rather than in security alerts. This list ranks the ten automated attacks that cause the most damage to online businesses, using the names and identifiers from the OWASP Automated Threats to Web Applications project, with how each one shows up, how to detect it and what actually stops it. It is written for application security, fraud, digital product and platform teams. For how bot detection works and how to buy it, read the Bot Management Guide and the Bot Management Buyer's Guide; this page is the short list of what goes wrong.

The Top 10 at a glance

The ranking is editorial, weighing how widely each attack is reported, how directly it turns into money lost and how often it appears in incidents and regulator findings, not a measured survey. Items 1 to 3 and 7 are fraud with a direct cash cost; items 4 to 6 hurt customers and margins more than security metrics; items 9 and 10 are the attacks that defeat defences against the others. A single bot operation often chains several: fake accounts (2) are created to sit behind scalping (4), stolen cards (3) and gift card balances (8) are tested in the same campaign, and CAPTCHA defeat (10) supports all of them. OWASP's list holds 21 automated threats; the eleven not ranked here, such as sniping, skewing, spamming and footprinting, matter in particular sectors and are covered in the Bot Management Guide.

1. Credential stuffing (OAT-008)

How it works: username and password pairs leaked from other breaches are replayed against your login, mobile API and password reset endpoints, betting on password reuse (MITRE ATT&CK T1110.004 Credential Stuffing). Traffic is spread across residential proxies so no single address trips a rate limit.

Real-world impact: in the 23andMe Breach 2023, reused passwords opened more than 18,000 accounts directly, and a relatives-matching feature turned that into data on almost 7 million people. One day of over a million login attempts caused an outage months before the breach became public. The New York Attorney General's business guide on credential stuffing describes an investigation in which the office collected credentials for more than 1.1 million compromised customer accounts across 17 companies.

Detect: login success ratio falling sharply, failed logins spread over many accounts with one or two attempts each, logins from hosting and proxy networks, and new device sign-ins followed by changes to email, address or payment details.

Fix: bot detection on login and reset endpoints, blocking passwords found in breach corpora, phishing-resistant or passwordless sign-in where customers will use it, and re-authentication before stored value or payment details are used. See the Password Spraying and Credential Stuffing Defence Guide and the Credential Stuffing Attack Response Playbook.

2. Fake account creation (OAT-019)

How it works: scripts register accounts at scale with disposable email addresses and virtual phone numbers to farm sign-up bonuses, referral credit and free trials, to post spam, or to hold accounts that later run scalping and payment fraud.

Detect: sign-up spikes, clusters of accounts sharing device characteristics or email patterns, accounts that never return after claiming an incentive, and bursts of new accounts using the same payment instrument.

Fix: score sign-up risk before the incentive is granted, not after; delay or hold rewards until an account shows normal behaviour; limit accounts per payment instrument and per verified phone number. See the Fake Account Creation and Sign-up Fraud Guide.

3. Carding and card cracking (OAT-001, OAT-010)

How it works: carding uses bots to test which stolen card numbers still work through small payments or authorisations; card cracking guesses the missing expiry date or security code for a known card number. Donation pages, card update forms and low-value checkouts are favourite targets because they show a clear success or failure.

Detect: authorisation decline rate rising, many small payments from new or guest accounts, many cards tried from one session or device, and a spike in payment processor alerts or disputes.

Fix: velocity limits per session, device, account and card bin; require an account or step-up check after repeated declines; use the payment processor's fraud controls and 3-D Secure where available; make declines look identical so the bot cannot learn which field was wrong. See the Card Testing and Carding Attacks Defence Guide.

4. Scalping (OAT-005)

How it works: bots buy limited goods, such as tickets, trainers, game consoles or appointment slots, the moment they go on sale, for resale at a markup. OWASP's API Security Top 10 2023 uses exactly this case to illustrate API6 Unrestricted Access to Sensitive Business Flows: an attacker scripts the purchase flow and runs it across many addresses on release day.

Detect: checkout completion times faster than any human, sell-out in seconds, many orders shipping to similar addresses with small variations, and resale listings appearing before the sale ends.

Fix: identify launch flows in advance and protect them as sensitive business flows; use verified accounts, purchase limits per person and payment instrument, randomised queues and post-sale order review that cancels duplicate orders. See the Ticket Scalping and Inventory Hoarding Bots Guide.

5. Denial of inventory (OAT-021)

How it works: OWASP defines it as depleting goods or services stock without completing the purchase. Bots fill baskets, hold seats or reserve hotel rooms, tables and appointment slots, so real customers see nothing available. OWASP lists other names including inventory hoarding, seat spinning and stock exhaustion.

Detect: high basket or hold rates with low conversion, holds that expire unpaid in large numbers, and repeated holds on the same items by new accounts.

Fix: short hold timers, limits on concurrent holds per account and device, deposits or payment details before scarce stock is reserved, and bot detection on add-to-basket and reservation endpoints, not only at checkout.

6. Scraping (OAT-011)

How it works: bots copy prices, product data, listings, content or user profiles at scale, for competitor pricing, content theft, lead harvesting or, increasingly, AI model training. Heavy scraping also adds infrastructure cost.

Detect: sequential or exhaustive crawling of catalogue and search pages, requests that never load images or scripts, high page views per session with no basket activity, and declared crawlers ignoring robots.txt.

Fix: decide what is allowed first, since some crawlers bring traffic; authenticate high-value data, rate limit search and listing APIs per account, avoid exposing whole datasets through predictable identifiers, and verify declared good bots before allowing them. See the Web Scraping Defence Guide and AI Crawler and Scraper Controls.

7. Cost-inflation fraud, including SMS pumping (OAT-003)

How it works: OWASP defines cost-inflation fraud as mass use of functionality to illegitimately profit from chargeable supporting services, and lists SMS pumping, toll fraud, click fraud, artificially inflated traffic and API usage inflation among its names; before version 1.3 of the handbook it was called Ad Fraud. In SMS pumping, bots request one-time codes to premium or high-cost number ranges, and the attacker shares the termination revenue while the victim pays the messaging bill.

Detect: one-time code requests that are never completed, traffic to country codes you have no customers in, and messaging spend rising faster than sign-ups.

Fix: allowlist the countries you serve, rate limit code requests per number, session and device, require a bot check before sending a paid message, and set spend alerts with your messaging provider. See Phone Number Fraud and Ad fraud and connected TV ad fraud.

8. Token cracking (OAT-002)

How it works: bots enumerate gift card numbers, voucher and coupon codes, loyalty identifiers and short reset or verification codes until valid ones are found, then drain balances or apply discounts.

Detect: high volumes of failed balance checks or code redemptions, sequential code attempts, and balance check endpoints called without any purchase.

Fix: long random codes with a PIN, lockout and rate limits on balance checks and redemptions, balance checks only for signed-in users, and masking of gift card numbers. The New York Attorney General's guidance also recommends restricting gift card transfers and re-authenticating customers before stored value is spent. See the Loyalty Points and Gift Card Fraud Guide.

9. Application-layer denial of service (OAT-015)

How it works: instead of flooding bandwidth, bots hit expensive endpoints such as search, basket recalculation, PDF generation, login with slow password hashing or AI features, exhausting application capacity at modest request rates (T1499.003 Application Exhaustion Flood). For paid APIs and AI features the harm can be a bill rather than an outage.

Detect: latency and error rates rising on a few endpoints while total bandwidth stays normal, and request mixes that no real user journey produces.

Fix: per-client and per-endpoint rate limits, caching, query cost limits, queueing for expensive work and budget caps on metered services. See the Denial of Service at Application Layer Guide and the Denial-of-Wallet and AI Agent Cost Runaway Guide.

10. CAPTCHA defeat (OAT-009)

How it works: challenges are solved by automated solvers or by paid human solving services, so a CAPTCHA adds cost to the attacker but rarely stops a funded campaign. The New York Attorney General's guidance notes that CAPTCHAs are less effective than bot detection because software and CAPTCHA farms can solve them.

Detect: challenge pass rates that look better than human, solve times that cluster unnaturally, and abuse continuing at the same rate after a challenge is added.

Fix: treat challenges as one signal among many, use them only for borderline scores, and rely on behavioural and device signals, rate limits and business rules for the decision. See CAPTCHA and bot challenges.

Detection: signals and metrics

Common failure patterns

• Protecting the web page but not the API: the mobile app and partner APIs reach the same login, checkout and code endpoints with no bot controls.
• Relying on IP rate limits: residential proxy networks spread traffic across so many addresses that per-IP limits never trigger.
• Granting incentives at sign-up: bonuses paid before any risk score, so fake accounts are profitable from minute one.
• Nobody owns the business flow: security watches the WAF, fraud watches chargebacks, product owns launches, and no one owns the checkout as a target.
• Measuring blocks instead of outcomes: reporting millions of blocked requests while takeover complaints, SMS bills and resale listings keep rising.
• Ignoring the warning outage: a login or sign-up surge treated as an availability problem, as happened months before the 23andMe breach became public.

Lessons from incidents

The 23andMe case shows three things this list keeps returning to. First, the attack used the login exactly as designed, so the signals were rates and ratios, not malicious payloads. Second, optional MFA and a weak password policy left most accounts exposed, and monitoring that could not see anomalous user behaviour let the campaign run for months. Third, a feature that shared data between accounts multiplied the impact of each takeover, which is why the business flow, not just the login, has to be part of the threat model. UK and Canadian privacy regulators later found breaches of data protection law, and the UK Information Commissioner's Office fined the company.

Mapping to OWASP

ATT&CK describes intrusions into an organisation, so most business-logic bot attacks have no technique; "None" is accurate rather than a gap. In NIST CSF 2.0 terms, the monitoring work sits under DE.CM-03 and DE.AE-02.

Where to start

1. Week one: list your sensitive business flows (login, reset, sign-up, one-time codes, checkout, holds, gift card balance, search) and who owns each.
2. Week one: baseline the metrics in the detection table for each flow so you can see an attack and measure a fix.
3. Weeks two to four: put bot detection in monitor-only mode on login, reset and one-time code endpoints, including mobile and partner APIs; review false positives, then enforce (items 1 and 7).
4. Month two: add business rules where they are cheap and strong: country allowlists for SMS, purchase limits at launches, short hold timers, delayed incentives, PINs on gift cards (items 2 to 8).
5. Month three: add endpoint cost limits and budget caps on metered services, and move CAPTCHA to a borderline-score fallback (items 9 and 10).
6. Ongoing: review outcome metrics monthly with fraud and product owners. Roll back an over-aggressive rule by returning that flow to monitor mode rather than removing the control.

Practitioner checklist

• Every sensitive business flow has a named owner and baseline metrics.
• Bot controls cover web, mobile app and partner API paths to the same endpoints.
• Breached password blocking and step-up on risky logins are live.
• Incentives are paid only after an account passes risk checks.
• One-time code sending is limited to countries you serve, with spend alerts.
• Gift card and voucher codes are long, random and PIN protected, with lockout.
• Launch flows have purchase limits and post-sale duplicate order review.
• Expensive endpoints have per-client limits and metered services have budget caps.
• CAPTCHA is a fallback signal, not the only control.
• Outcome metrics, not block counts, are reported to the business.

Standards and references

• OWASP: Automated Threats to Web Applications
• OWASP: OAT-003 Cost-Inflation Fraud
• OWASP: OAT-021 Denial of Inventory
• OWASP: API6:2023 Unrestricted Access to Sensitive Business Flows
• New York State Attorney General: Business Guide for Credential Stuffing Attacks
• MITRE ATT&CK: Credential Stuffing
• MITRE ATT&CK: Application Exhaustion Flood

Related NHI Mgmt Group resources: Bot Management Guide · Bot Management Buyer's Guide · Account Takeover Prevention Guide · Bot vs AI Agent Traffic Management Guide