Your Password Was Stolen Years Ago. Criminals Are Still Using It

In early 2023, a freelance graphic designer in Austin named Marcus noticed something odd. His streaming account had been watching Turkish soap operas at 3 am. His airline miles had quietly transferred to an unknown address. His online pharmacy had processed a refill he never requested. Marcus hadn’t been hacked in any dramatic sense. There was no ransomware pop-up. No urgent email from IT. Someone had walked through his front door using a copy of his key — a password he’d reused across a dozen services, originally leaked in a 2019 retail data breach he never knew about. Platforms relying on traditional fraud detection never flagged it. By the time a chargeback triggered an alert, the damage was done. This is the defining failure of modern login security, and it’s why building real account takeover prevention into the authentication layer — not after it — has become the defining security challenge for every platform handling user accounts in 2025.

Marcus’ story is nothing unusual. It’s Tuesday. Industry fraud-tracking data estimates that US consumers and platforms lost $15.6 billion to account takeover fraud in 2024 alone. That figure will continue to climb to a projected $17 billion in 2025. The number of suspected ATO fraud cases increased by 37% year over year from 2024 to 2025. The volume of credential stuffing – the automated technique that recently got Marcus – increased by 148% year-over-year through Q4 2025. These are not ‘cybersecurity’ statistics. These are the line items on their balance sheet that are quietly undermining platform revenue, brand equity, and customer trust – one session at a time.

How Account Takeover Actually Works in 2025

Get out of that shady hooded jacket and forget the movie hacker. Modern account takeover is a logistics affair. Criminal networks buy leaked databases of billions of usernames and passwords from past breaches at retailers, health services, and game providers, then use automated bots to test those credentials on banking apps, e-commerce sites, and SaaS tools. It works because users reuse their passwords. A small proportion of stolen pairs will be rewarded with something valuable. All the attacker is required to do is a small amount.

The evasion infrastructure has been greatly developed. Now hackers no longer try to attack login pages from a single IP address. They send the attempts through rotating residential proxy pools, Tor exit nodes, commercial VPN providers, and anti-detect browsers that are designed to resist fingerprinting. They cycle cookies. They alternate between incognito windows. They forge geolocation headers. On the platform’s end, each attempt looks like a new, anonymous user. The relationship between attempt 1 and attempt 10,000 is not evident at the session layer and only becomes apparent at the device layer.

There’s the “low and slow” attack, of course. Smarter attackers circumvent the rate-limiting system by making thousands of requests in an hour or day, keeping them below the velocity limits. More sophisticated attackers make thousands of requests in an hour or day, under the rate limit. They appear to be a part of normal traffic. In all statistical senses, they’re not unusual traffic. Your rate limiter is not phototropic.

Once in, the time to become damaged is amazingly short. Payment methods stored are tested. Loyalty points are passed on—information that is personally identifiable, such as information for resale or for additional phishing. ATO is one area where financial fraud and identity theft are leading complaint categories at the Federal Trade Commission over the past few years. The time between the fraud signal hitting downstream and the time it’s actually sent for the fraud can be long by the time you find out, by which point the attacker is likely long gone.

MFA Solves a Different Problem Than You Think

Yes, multi-factor authentication has a value. It confirms that the user signing in has another factor, such as a code, app, or hardware key. The real protection is against pure credential-theft-type fraud. However, what MFA doesn’t care about is the source device of the login, the network traffic that was used, or the context of the login attempt. In the above scenario, if the attacker also has the phone number or email address of the target, a credential pair sent by them via a Tor exit node through an anti-detect browser, after 3000 failed attempts over 48 hours, will be passed through MFA. The ability to port a victim’s phone number to a SIM the attacker controls, known as SIM swapping, is specifically designed to circumvent SMS-based two-factor authentication. It’s not exotic. It’s a well-known and scalable attack strategy.

The rate-limiting problem has the same structural issue. It measures velocity. Attackers track the velocity as well and slow it down accordingly. Blocking based on IP is even more fragile. Residential proxy networks provide the attackers with practically unlimited clean IP addresses to switch between. Blocking a range of suspicious IP addresses is like playing whack-a-mole against a foe with millions of exit points on residential IP address ranges.

Added to this are the static fraud rules. Security teams write rules based on information from past attack events. Attackers try to challenge the rules, locate the edges, and modify them. The rule set is always current 1 version behind. But most mid-market platforms do not have the staffing level of a fraud operations team needed to continuously maintain, tune, and update those rules. Sometimes, the time between the appearance of a new attack pattern and the time that a rule captures it can be as long as weeks of financial exposure.

All these failures have one thing in common: they were all missed opportunities for timing. All are located downstream of access being granted. The transaction fraud tool is activated when a fraudster gains access to the account. The chargeback system is activated after money has been moved. The customer service ticket is triggered after the customer finds the damage. None of them will prevent the illegal login from occurring in the first place.

The Upstream Fix: Catching Fraud Before the Session Starts

For effective account takeover prevention, the detection must be shifted to the left. Not to the transaction in particular. Not to the logged-in session. Before anyone is granted access, to the login event itself; that is, it ignores three things about the login attempt that are crucial but omitted by credential-only verification: the device making the login attempt, the connection the device is using to do so, and the context of the session in which the login attempt takes place.

The fundamental is device identity. This isn’t just a matter of “are these credentials valid? It’s “is this the device that has traditionally accessed this account? A persistent device identifier, which can be remembered across sessions after the reset of all apparent identity signals, will be able to identify a returning visitor even if the attacker resets each of the signals. That’s the space that a session-based ID does not fill. Current device fingerprinting methods can restore a consistent device ID from hardware, browser, and environmental clues that anti-detect browsers can’t really spoof. An anomaly, by definition, is an individual using a credential that was purchased on Tuesday last week and has never been used on the target account. Flag that. Ask them to show more before accepting them.

The integrity of the connections is just as important. A login from a known vpn provider, a Tor exit node, or a residential proxy that is known to the account holder from the past is much riskier than a residential ISP that has been used by the account holder for the past 02 years. The ability to successfully identify those anonymization signals, close to 99% accurate, with research suggesting detection rates in VPN, proxy, and Tor infrastructure, adds an invisible signal to an actionable risk input.

Risk scoring combines both of these. Rather than a yes/no (allow/block) decision based on a single signal, a 0-100 risk score using dozens of correlated signals yields far fewer false positives than any single signal. A 12-point risk rating on a familiar device via a familiar home Internet provider is safe. If the device isn’t recognized, it’s connected to a VPN, and the timezone differs from the one stated in the “geolocation” field, it gets a “step-up challenge” (or a block if the platform’s threshold is lower). The decision is theirs to make. The signal is given by the scoring engine.

What “Friction-Free for Real Users” Actually Means in Practice

The first thing that comes to mind for objection-raising product teams is conversion. Each extra layer of security causes a certain number of users to get frustrated and lose interest, and never come back. That’s a real cost. That’s why blanket MFA requirements cause hard-to-avoid conflict between revenue and security teams. This isn’t the solution: picking one over the other. They are meant to add friction only where it is necessary, if there is a risk.

But when step-up authentication triggers only when logins reach a certain risk level, the vast majority of legitimate logins (those from a user’s normal device, normal network, normal geography) aren’t challenged. They’re not aware of the system. They jog in. Only sessions that appear anomalous will show the 2FA prompt, the CAPTCHA, or the “we sent you a verification code” message. It is no trade-off in terms of security. That is precision-targeted friction!

The more efficient it is, the more efficient it will become. The more time that passes, the more known-good devices and connection patterns an individual is tracked and verified, and the fewer logins that will require other forms of verification. The system learns what normal looks like for each customer. The friction falls. Complete coverage remains.

The platforms that have adopted this approach — which can be referred to as a “friction-right” authentication stack — are doing what Marcus’ streaming service, airline, and pharmacy never did: thinking about the context of the session before giving them the keys, rather than after they’ve wreaked some havoc on the spreadsheet.

The Brand Damage Nobody Puts in the Press Release

The $15.6 billion loss to the ATO each year reflects direct financial losses. It doesn’t capture the customer who closes her account after learning someone else accessed it without permission and then doesn’t tell anyone. It doesn’t count the loss of trust when a user tells three friends about the platform where their account was hijacked. It also doesn’t reflect the regulatory risks that state-level data protection laws—and a far more aggressive FTC—view as an organizational failure for not having stronger account security.

83% of organizations reported at least one ATO incident in the last time periods tracked. According to several industry surveys, ATO is now the biggest concern for enterprise security. It’s disproportionately affecting fintech, e-commerce, and SaaS platforms, where it is easy to monetize account access and where user trust is the product.

It’s not a lack of technical ability here. Many security teams know MFA isn’t infallible. The vast majority of fraud teams are aware of the drawbacks of static rules. The failure is structural: Fraud detection has traditionally been defined by transactions because there is a visible change of money with transactions. It looked like an infrastructure issue, not a fraud surface for login events. This view of the world is now out of sync with how attackers operate. The credential-stuffing bot isn’t concerned with your transaction fraud system. It requires just three seconds to get what it’s looking for without being challenged.

What Platforms Can Actually Do About This Now

The architectural requirement is obvious: detection should shift to the login level, happen before access, and consider the context of the device and connection (not only the validity of the credentials). Pre-built detection patterns for credential stuffing, impossible travel, and ATO-specific behavioral signatures decrease the time-to-protection for teams without a fraud operations team. From no risks at all to working levels of protection in one sprint, without having to start from scratch with the authentication stack.

The model in operation also has an impact. Putting the enforcement decision inside a black-box system, as opposed to a scoring engine that returns a risk score and signal breakdown via API and webhooks. Security teams can configure thresholds. Product teams can adjust friction levels. Signals are clear, traceable, and changeable with the progression of the attack pattern. This is a different approach than what MFA expects or opaque fraud tools that yield allow/block output that make no explanation.

Marcus regained his merits, however. It took 12 support tickets, 4 weeks, and a new email address. He never got his miles back. The pharmacy did not make the incident public. The streaming service refunded him because of the escalation. None of these platforms knew about the attack until afterward. None of them could see the device and connection that sparked it all with the login. That’s the gap. It’s closeable. The question is whether platforms will close it before the chargeback comes or after.