The term credential theft is not new. Lynch explained attackers hack into a system to steal end-user login credentials: user IDs, email addresses, passwords. Or they phish users into credential theft. “I can't believe this many years later we're still talking about phishing, but it's still a huge issue.”

Lynch provided some of the newer terms used in relation to credential theft:

• Credential stuffing. Fraudsters use bots to test stolen account credentials to access user accounts through large-scale automated login requests. “They want to validate that they have a good user name with potentially a good password.”
• Password recycling. Using the same password against multiple online accounts.
• Credential spilling. Fraudsters release massive amounts of user credentials onto the dark web. Sometimes it is free to build their own hacker résumé, or sometimes for profit.

The return for fraudsters depends on the value of credentials. “For 1 million stolen credentials, which these days is not that much, they might gain access to 10,000 accounts. If those are financial accounts, you have a lot of effects on the FIs,” Lynch said. He added, possible consequences include the hard-dollar costs in detecting the credential compromise, the aftermath cleanup, potential reputational damage, and response to inevitable customer queries.

Among the techniques hackers use to gain credential access are phishing and smishing (SMS based phishing), credential cracking with brute force, man in the middle attacks, and insider theft.

Fraudsters obtain financial institution credentials to sell to the highest bidder. Lynch held account logins for financial institutions have a longer shelf life and are getting a higher price from the dark web. “The most direct and obvious use of account takeover is transaction fraud,” Lynch said. With the financial institution, it is usually fraud against the consumers' account. “Fraudsters sometimes have this information for several years before it's even noticed it's been compromise or reported that it was compromised.”

Credit card numbers are lesser valued on the dark web because holders are pretty quickly notified of compromise and the issuer subsequently retires the cards.

Companies are now battling bots used to stuff credentials. Some signs bots are in play is through more traffic to the site, higher attempts to login, and more than usual login failure rates.

“They're using automation and technology to do things like credential cracking and the bots themselves create the malware and distribute it, Lynch said. “They are quite sophisticated.”

The theft of user credentials and their use in attacking other sites is now so widespread that it prompted precautions in the “Draft NIST Special Publication 800-63B Digital Identity Guidelines,” that online account systems check their users' passwords against known spilled credential lists.

Lynch suggested credit unions need to check the unique device, device fingerprinting, and malware detection. In addition, financial institutions should use behavioral analysis. He also recommended credit unions embrace new authentication techniques like biometrics. “The more financial institutions adopt biometrics the less credential compromise we will have.”