IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Account takeover — defending the customer's account
Maya's shopping account holds a saved card, loyalty points and her home address. To an attacker who runs millions of logins a night, that is real money. Your goal: keep her account hers without making her hate the login screen.
- Account takeover is a volume business at consumer scale.
- Three roads in: reused passwords, phishing and abuse after login.
- No single control works. Use layers: cheap filters first, precise ones later.
- Watch behavior after login, not only at the door.
- Put friction only where the risk is. Passkeys remove the password.
Why Maya's account is worth stealing
Account takeover (ATO) means an attacker gets into a real user's account and uses it as their own. At consumer scale there are millions of customers and no IT help desk. The prize is stored value: a saved card, loyalty points, a gift-card balance. One stolen account may be worth a few hundred rupees. A million of them is a living.
Picture the morning after. Maya finds an order she never made, sent to a stranger and paid with her saved card. Her points are gone. She blames your app, not the attacker.
How the attacks arrive
Attackers rarely guess Maya's password. They already have it, or one she reused. Three roads lead to her account.
♻️ Credential stuffing
Credential stuffing means replaying username and password pairs that leaked from other sites. A breach dump is a list of stolen pairs. A bot feeds the list into your login form, betting that Maya reused her password. Most tries fail, but enough succeed to pay. See breached-password detection and credential stuffing, password spraying and bots.
🎣 Phishing
A fake login page steals Maya's real password and even her one-time code, live. The worst kind is adversary-in-the-middle, which passes her session on in real time. Classic MFA alone does not save her.
🛒 Abuse after login
Once inside, the attacker changes the shipping address, adds a new card and drains the points. This is the cash-out. The login was only the front door.
Layers, not one lock
No single control stops ATO. Put cheap, broad filters first and costly, precise ones later. Each gate stops a slice of the attacks before the cash-out.
| Gate | What it does | Deeper dive |
|---|---|---|
| Breached-password check | Refuses passwords found in public breach dumps | Breached-password detection |
| Bot / stuffing detection | Spots thousands of logins from a botnet, and challenges or blocks them | Bot detection |
| Adaptive (risk-based) login | Scores each login (new device, odd place, impossible travel). Asks for MFA only when risky | Adaptive risk-based MFA |
| Passkeys | A key tied to the device. Nothing to stuff or phish | Passkeys & WebAuthn |
Watch what happens after login
Even a clean login can belong to an attacker who phished their way in. So the last gate watches behavior. Say an account signs in from a new device, and within minutes changes its shipping address and asks for a gift-card payout. That is the classic cash-out pattern. Score it, freeze the payout, email Maya and ask for a step-up before any money moves. (See detection engineering.)
Security versus the customer
Every friction you add against attackers also lands on Maya, such as a CAPTCHA on every login or MFA on every visit. Each one pushes customers away. The art of CIAM is to put friction only where the risk is. Stay quiet for Maya on her usual phone. Be firm for a botnet from far away. A passkey is the rare win: safer for Maya, and less typing for her too.
a lift in an office tower. Everyone rides it freely. Only the top floors, with the server room and the cash room, need a key card. Nobody asks for a card at every floor.
Go deeper: Passkeys for customers today (as of October 2026)
The FIDO Alliance State of Passkeys 2026 report (7 May 2026) surveyed 11,000 adults in 10 countries in April 2026. It found that 90% know about passkeys and 75% have turned them on for at least one account. It estimates that about 5 billion passkeys are in use. Awareness is not the same as habit. Offer a passkey at a good moment, such as right after a successful sign-in. Keep a safe fallback for people who are not ready. Remember account recovery: a passkey login with an SMS fallback has only SMS strength.
Go deeper: Attackers adapt
Block credential stuffing, and attackers switch to phishing. Add MFA, and they move to live relay. There is no finish line. Keep tuning your layers.
Go deeper: More defenses from OWASP
The OWASP Credential Stuffing Prevention cheat sheet lists many controls and warns that each has limits. MFA is the strongest. Breached-password checks only catch passwords that are already known. Device fingerprinting can be faked. CAPTCHAs can be broken and annoy real people. IP blocking is weak because attackers spread traffic across many addresses. Requiring JavaScript can hurt people who use screen readers. The advice is to layer controls, measure each one, and tell users about suspicious sign-ins without flooding them with alerts.
🧪 Interactive lab — enable JavaScript to play with this one.
See how phishing-resistant your own login really is. Grade your passkey and WebAuthn setup with Passkey Check. Then harden the session that login creates with Cookie Check.