EXPLAINERS

How stolen passwords get used — from breach to account takeover, and passkeys

A breach leaks email and password pairs from one site — but those pairs are then used as keys to other sites where the same combination was reused. This explainer follows how credential stuffing breaks into accounts, where MFA has gaps, and why passkeys resist fake login pages, with diagrams that move as you scroll.

Published: October 30, 2026 ・ Sources verified as of October 30, 2026

253cases

Unauthorized transfers reported (H1 2026, internet banking fraud)

¥2.07billion

Total losses (down 51% year over year)

Figures from Japan's National Police Agency. The report notes that technical measures such as email verification and multi-factor authentication alone are not sufficient — everyday awareness matters, too.[2]

01What is happening now

Checking whether your account was in a breach is not where it ends. The stolen pairs are used to sign in to other sites — the ones where you reused the same password. The diagram traces how leaked pairs get stuffed into login forms.

Schematic diagram — does not show actual ratios or scale.

STEP 1

Pairs are stolen in breaches and phishing

Attackers obtain username and password pairs from database breaches, phishing, and password dumps.[3]

Because many people reuse the same combination, those pairs are worth trying against dozens to hundreds of other sites.[3]

STEP 2

Lists are compiled and traded

The pairs are compiled into lists and traded on underground markets. How stolen data circulates is diagrammed in the dark web chapter of our World page.

Credential stuffing is one of the most common techniques behind account takeover.[3]

STEP 3

Automated tools stuff them at scale

Using automated tools, attackers feed the stolen pairs into the login forms of many sites in bulk. It is a form of brute force, but instead of guessing, it uses real, already-leaked pairs.[3]

When a try succeeds, the attacker knows the pair is a valid credential.[3]

STEP 4

Only the sites where you reused the password break

Sites with a unique password reject the login. What breaks is the site where the same pair still worked.

Taken-over accounts are used to extract or purchase stored value, to view card numbers and personal information, as a springboard for phishing and spam, or the valid credentials are sold to other attackers.[3]

Where the numbers stand

In Verizon's DBIR 2026 (data through November 2025, over 22,000 confirmed breaches, 145 countries), credential abuse accounted for 13% (n=19,905) of initial access vectors — overtaken by exploitation of vulnerabilities, now first at 31%.[1]

Note that this 13% is the share among known initial access vectors, not the share of breaches in which credentials were used at any stage.[1]

And among third-party cloud accounts, only 23% of organizations had fully remediated missing or incomplete MFA. Unfinished hardening is still letting attackers in.[1]

OWASP lists multi-factor authentication as the primary mitigation for credential stuffing.[3] So where are MFA's gaps? That is the next chapter.

02Why it works

Don't reuse passwords and you're safe; enable MFA and you're safe — the second half of that collapses. MFA has gaps: fake pages that relay what you type, and attacks that wear you down until you approve. The diagrams show how a password and a one-time code get stolen — and where a passkey stops.

PASSWORD + CODE

You type the password and a 6-digit code into a fake site

A typical phishing setup recreates a convincing copy of the real login page and asks not only for your username and password, but also the 6-digit code from your authenticator app.[4]

RELAY

The fake site relays it to the real one, and the login succeeds

What you enter is forwarded immediately from the fake site to the real one. Because the real person is entering a valid code, the login succeeds and the attacker rides into that session. You think you signed in to the real site — but the traffic passed through the fake one.[4]

PUSH FLOOD

Push bombing: notifications until you approve

Push-notification MFA can be attacked with push bombing (push fatigue): the attacker keeps sending approval prompts until a tired or hurried user taps Approve.[4]

PASSKEY

A passkey cannot be used on the fake site

Public-key credentials are scoped to the origin of the relying party they belong to. The browser and the authenticator enforce that scope together, so a passkey created for the real site cannot be used on the fake site's domain — and cannot be relayed either.[6]

The four tiers of MFA strength[4]

Phishing-resistant MFA (FIDO / WebAuthn, PKI)Gold standard
Weak against: Push bombing, SS7 and SIM swap do not apply
Authenticator app (one-time codes, push with number matching)
Weak against: Phishing (relay through a fake site)
Push notification without number matching
Weak against: Push bombing and user mistakes
SMS / voice
Weak against: Phishing, SS7, SIM swap — the last resort

Bar lengths indicate rank (schematic), not measured values.

CISA calls phishing-resistant MFA (FIDO/WebAuthn, PKI) the gold standard. Number matching is the additional mitigation when you cannot yet move to phishing-resistant MFA.[4]

What push bombing looks like

Approval prompts arriving one after another while you are not logging in — that is the sign of an attack. CISA flags push notifications without number matching as weak to push bombing and user mistakes.[4]

With number matching, you must enter the number shown on screen, so merely tapping through notifications does not approve anything. It is recommended as an additional measure when migrating to phishing-resistant MFA is not yet possible.[4]

An unending stream of approval prompts (schematic)

With number matching: you must type the number shown — approval alone won't sign in

03How to defend

Ordered by priority — start with what you can do today.

Eliminate reuse, starting with email, banking, and telecom/ID accounts

Use a password manager and set a unique password per site (we do not recommend specific products).

NIST SP 800-63B-4 requires at least 15 characters when a password is used alone (at least 8 as part of multi-factor authentication), prohibits composition rules and forced periodic changes, and requires checking passwords against blocklists of leaked and commonly used passwords.[5]

Enable passkeys

1.Open the Security settings of each service
2.Choose Create a passkey
3.Confirm with the device's biometrics or screen lock
4.From the next sign-in, remember: a fake site will never ask for it (it cannot use it)

On services without passkey support, use authenticator-app MFA. SMS is the last resort.[4]

Japan's National Police Agency is also urging service providers to promote passkeys — authentication that replaces passwords with something easy and safe, such as biometrics.[2]

Never approve a push notification you did not trigger

A rapid succession of notifications is a sign of an attack. If a service offers number matching, turn it on.[4]

Don't sign in from links in email

The NPA notes that technical measures such as email verification and multi-factor authentication alone are not sufficient: do not click links in messages casually, and access services from the official website or official app.[2]

If you learn your password leaked

Change the password on that service and on every service where you used the same one, then enable MFA or a passkey.

If you were harmed, the contacts are in If you were affected. To look up leak incidents, use Breach Watch and the incident list.

Sources

Sources verified as of October 30, 2026. This article provides general information; for your specific situation, follow each service's official guidance.