What is credential stuffing?
Credential stuffing is a high-volume attack that tries leaked passwords against your login API until a pair works, often from many IPs or a single scripted device farm.
What the login event must carry
Send user.login with customer external id when known, device fingerprint, IP, and a stable session id. Count failures per IP, device, and identifier in short windows. Stuffing looks like many failures then a success on a new device.
How Naiza applies it
Use velocity rules and device intelligence on login. Product pages describe blocking credential stuffing and brute force in real time. Start in REVIEW, then BLOCK confirmed stuffing fingerprints and IPs via lists.
MFA is not a substitute for telemetry
Attackers stuff accounts that lack MFA or that reuse SMS OTPs. Still instrument the login event so you can explain why a session was challenged.
Frequently asked questions
Short answers written so search and answer engines can cite them.
What is credential stuffing vs brute force?
Brute force guesses passwords on one account. Stuffing tries many accounts with known leaked pairs. Velocity windows and unique-user counts distinguish them.
What is a credential stuffing API defense?
Evaluate the login event in a fraud API, return ALLOW, REVIEW, or BLOCK, and list abusive devices or IPs. It does not replace password hashing or MFA.
Should every new-device login be blocked?
No. New phones are common. Pair novelty with failure velocity and known-bad fingerprints.