Credential stuffing has grown from a background cybersecurity concern into one of the more significant drivers of unauthorized transaction chargebacks for online merchants. The scale of the problem has expanded considerably since 2020. In June 2025, cybersecurity researchers revealed that a record 16 billion login credentials had been exposed online in what is believed to be the world’s largest password leak to date. That volume of available stolen credentials gives attackers an essentially unlimited supply of raw material for automated attacks. Merchants operating online account systems sit directly in the path of those attacks.
The payments implications receive less attention than the cybersecurity dimensions of credential stuffing, but they are equally significant. When attackers successfully compromise merchant accounts, the transactions they initiate generate unauthorized transaction disputes that land back on the merchant as chargebacks. For acquirers and processors, understanding this connection is important because many merchants don’t recognize credential stuffing as a chargeback driver until their dispute ratios have already climbed.
How Credential Stuffing Works
Credential stuffing begins with stolen data. Attackers acquire large databases of username and password combinations from data breaches, dark web markets, and public leak repositories. They then use automated tools to test those credentials against merchant login portals at high volume and speed, relying on the fact that many consumers reuse the same passwords across multiple sites. According to the 2025 Verizon Data Breach Investigations Report, cyber attackers exploit stolen or brute-forced login credentials in 88% of hacking attacks.
What has changed most significantly since 2020 is the sophistication of the tools attackers use. Early credential stuffing relied on simple scripts that were relatively easy to detect through standard security monitoring. Modern attacks use botnets, proxy rotation, and AI-driven tools that mimic human browsing behavior. The increased sophistication of scripted attacks allows bots to perform tasks that emulate human behavior, including mouse movements, typing patterns, and browsing behaviors, making traditional bot detection less effective.
The practical result is that attacks now operate at a scale that was difficult to achieve even a few years ago. Akamai’s 2024 Securing Apps report recorded 26 billion credential stuffing attempts per month. Merchants with account systems that lack modern authentication controls face a persistent and automated threat that operates continuously without human intervention on the attacker’s side.
The Chargeback Connection
A successful credential stuffing attack doesn’t end with account access. Once an attacker gains entry to a merchant account, the account becomes a vehicle for fraudulent transactions. Stored payment methods get used for unauthorized purchases. Loyalty points and store credits get redeemed or transferred. Shipping addresses get changed to redirect physical goods. Each of these actions generates disputes that flow back through the payment system as unauthorized transaction chargebacks.
ATO-related chargeback losses are 76% higher than typical chargebacks, reflecting both the higher transaction values that attackers tend to target and the difficulty merchants face in successfully contesting these disputes. The challenge in dispute response is straightforward: when a legitimate cardholder claims they didn’t authorize a transaction, and the transaction was indeed initiated by an attacker rather than the account holder, the merchant’s standard evidence of a completed transaction doesn’t address the core claim. Proving that an account was compromised rather than simply disputing the cardholder’s claim requires a different category of evidence that many merchants aren’t prepared to provide.
The secondary costs extend beyond individual chargeback losses. According to a 2025 Javelin report, 42% of ATO victims closed the accounts where the fraud occurred. Merchants absorb customer attrition on top of dispute losses, along with operational costs from fraud investigation, account remediation, and customer communication. For merchants in card network monitoring programs, ATO-driven chargeback spikes can accelerate threshold breaches that create additional fee exposure.
How to Recognize an Attack in Progress
Credential stuffing attacks leave identifiable patterns that merchants can monitor for, but recognizing those patterns requires knowing what to look for. Several indicators typically appear before unauthorized transaction chargebacks begin surfacing in volume.
Unusual spikes in failed login attempts
These represent the most direct signal. Credential stuffing generates high volumes of authentication failures as automated tools work through credential lists. A sudden increase in failed logins, particularly from multiple IP addresses or unfamiliar geographic locations, suggests automated attack activity rather than normal user behavior.
Increased account lockout rates
These follow the same pattern. When rate limiting or lockout policies trigger at higher than normal frequency, it indicates that login attempts are being made at speeds and volumes inconsistent with human users. This signal is particularly useful because it appears early in an attack, before successful compromises occur.
Geographic anomalies in login traffic
Anomalies provide additional confirmation. Successful logins from locations that don’t match a customer’s established usage pattern, or simultaneous login attempts from geographically distant locations within short timeframes, indicate compromised credentials being tested by attackers operating through distributed networks.
A sudden increase in unauthorized transaction disputes
When ATO-driven chargebacks start appearing in volume, the underlying attack has typically been underway for some time. Merchants who wait for dispute data to identify attacks are already absorbing losses that earlier detection might have prevented.
What Acquirers & Processors Can Do
The most valuable contribution acquirers and processors can make is helping merchants understand the connection between credential stuffing and chargeback exposure before an attack occurs. Many merchants treat account security as a separate concern from payment risk management, maintaining siloed teams and systems that don’t share information effectively. Processors who frame credential stuffing explicitly as a chargeback risk driver help merchants close that gap in their thinking and their operations.
Portfolio-level monitoring provides processors with visibility that individual merchants lack. Patterns that appear minor at the merchant level can be significant across a portfolio; a credential stuffing campaign targeting a specific vertical or platform often hits multiple merchants simultaneously. Processors who monitor for correlated ATO indicators across their portfolio can identify emerging attacks earlier than any individual merchant would and communicate relevant warnings to affected merchants proactively.
Authentication improvement guidance helps merchants reduce their exposure without requiring deep technical expertise. Multi-factor authentication is the single most effective control against credential stuffing because stolen passwords alone become insufficient for account access. Processors who make MFA adoption a standard recommendation in merchant onboarding and periodic review conversations contribute directly to lower ATO-driven chargeback rates across their portfolio. The guidance doesn’t need to be technical; pointing merchants toward available tools and explaining the chargeback reduction benefit is sufficient to motivate many merchants who might otherwise deprioritize the investment.
Dispute response support for ATO-related chargebacks requires a different approach than standard transaction disputes. Winning these disputes depends on demonstrating that account security controls were in place and that the compromised access was anomalous rather than the result of merchant negligence. Processors who help merchants understand what evidence is relevant, including login anomaly records, IP address data, and device fingerprinting information, improve their merchants’ win rates on a dispute category that many handle poorly by default.
Escalation judgment matters when a merchant’s credential stuffing exposure appears severe. A merchant experiencing a sustained attack without adequate controls in place presents portfolio risk that warrants direct engagement rather than routine monitoring. Processors who identify these situations early and intervene with specific remediation guidance protect both the merchant relationship and their own dispute ratio exposure. Waiting for chargeback thresholds to breach before escalating concern is a reactive posture that consistently costs more than proactive engagement would have.
Credential stuffing represents exactly the kind of risk that sits at the intersection of cybersecurity and payments operations; familiar enough that merchants assume someone is handling it, specific enough in its chargeback implications that it often falls through the gap between security and finance teams. Acquirers and processors who understand both dimensions are better positioned to help merchants close that gap before it shows up in their dispute ratios.
