What is credential stuffing?
Credential stuffing is a high-volume attack that tries leaked passwords against your login API until a pair works, often from many IPs or a single scripted device farm.
What the login event must carry
Send user.login with customer external id when known, device fingerprint, IP, and a stable session id. Count failures per IP, device, and identifier in short windows. Stuffing looks like many failures then a success on a new device.
How Naiza applies it
Naiza evaluates login events with velocity rules, device intelligence, and lists. Review suspicious bursts, then apply BLOCK to confirmed abusive fingerprints and IPs.
Combine authentication and event monitoring
Attackers stuff accounts that lack MFA or that reuse SMS OTPs. Still instrument the login event so you can explain why a session was challenged.
Frequently asked questions
Answers about screening, risk signals, and Naiza integration.
What is credential stuffing vs brute force?
Brute force guesses passwords on one account. Stuffing tries many accounts with known leaked pairs. Velocity windows and unique-user counts distinguish them.
What is a credential stuffing API defense?
Evaluate login events with Naiza and route ALLOW, REVIEW, or BLOCK into the authentication flow. Combine device, velocity, IP, and confirmed-abuse lists with your authentication controls.
Should every new-device login be blocked?
No. New phones are common. Pair novelty with failure velocity and known-bad fingerprints.