Clear Path step · Business · Your industry's rules and risks
Protect customer accounts from credential stuffing
Why it matters: Criminals test leaked passwords against store logins to steal stored value, loyalty points and saved cards. Bot protection and passkeys make that unprofitable.
On your path if you picked “Retail and e-commerce” for “What's your industry?”.
Do it
- Turn on your platform's bot protection, rate limiting or CAPTCHA on login and checkout.
- Offer passkeys or MFA for customer accounts if supported.
- Email customers when their password, email or address changes.
- Watch for spikes in failed logins or small card authorizations, a sign of card testing.
Check it worked: Your store blocks automated login attempts, offers customers passkeys or MFA where the platform supports it, and alerts customers to new sign-ins and changes.
Simply put
It's like a bouncer who notices someone trying key after key on the door. Bot protection and passkeys make testing leaked passwords on your store slow and unprofitable, so loyalty points and saved cards stay with customers.
In detail
Card testing uses your checkout to check stolen cards with tiny charges, and can get your merchant account flagged; velocity limits at checkout are the fix.
Points toward the Long View: customer accounts where leaked passwords stop paying off for attackers.