Credential stuffing defense for gambling accounts

Credential stuffing is automated login attempts using username and password pairs leaked from other services. It works because people reuse passwords. OWASP lists it as OAT-008 in its catalog of automated threats, and its own guidance is clear that no single control stops it: MFA, breached-password checks and graduated rate limits work best together.

By Martin Huml · Published October 24, 2026

Scope

Login and registration defenses; OWASP, NIST, NCSC and ICO guidance

Sources checked

October 24, 2026

Next review

April 24, 2027

What credential stuffing is

The NCSC describes how credential stuffing "takes advantage of people reusing username and password combinations across different accounts". Attackers take credentials leaked from an unrelated breach and try them at scale against login pages. A small success rate across a large list is enough to compromise accounts. OWASP's Automated Threats to Web Applications project, whose v1.3 handbook was published on 17 March 2026, catalogs it as OAT-008 Credential Stuffing, distinct from OAT-007 Credential Cracking (guessing passwords).

Controls, in order of value

Login design choices

• Do not reveal which part was wrong. The same message for unknown username and wrong password avoids helping attackers confirm valid accounts. OWASP's multi-step login advice warns against enabling user enumeration.
• Consider usernames that are not email addresses. OWASP notes that letting users create their own username makes credential stuffing harder, since leaked lists are usually email-based.
• Protect registration too. Automated account creation (OAT-019) is a separate threat, often linked to bonus abuse; see our bot mitigation guide.

Monitoring for an attack

Watch aggregate signals rather than single accounts: failed-login rates across the platform, logins from many accounts sharing devices or networks, sudden rises in password resets, and successful logins followed by immediate changes to withdrawal details. A spike in failures alone does not prove an attack; a marketing campaign or outage can cause one. Correlate with other signals before blocking at scale.

A documented case: the November 2022 attack on a US sportsbook

DraftKings' breach notice to the Maine Attorney General describes "credential stuffing attacks" that began and were discovered on 18 November 2022, affecting 67,995 people, with customers notified on 16 December 2022. Its notice to Massachusetts residents says the attacks may have involved access to usernames or emails and passwords, that "a limited number of users may have had funds improperly withdrawn", and that the company restored withdrawn amounts for certain accounts. Its 2025 annual report says the credentials may have come "from a non-DraftKings source".

Federal prosecutors in New York, describing an attack on "a fantasy sports and betting website" on or about 18 November 2022, said about 60,000 accounts were accessed and about $600,000 taken from about 1,600 of them. Three men were sentenced to between 18 and 30 months in prison. The prosecutors' releases do not name the company, and their account figure differs from the company's notice, so we quote each source as stated.

The case shows the pattern this guide describes: credentials leaked elsewhere, replayed at scale, followed by changes that let money leave. MFA, breached-password checks and protection of withdrawal details are the controls that break that chain.

After a confirmed attack

Force resets for affected accounts, revoke their sessions, notify the players, and review whether any personal data breach must be reported. In the UK, the ICO says that if a risk to people is likely, organizations "must notify us, as soon as possible, and where feasible within 72 hours". Our account takeover guide sets out a full response sequence.

Questions about credential stuffing