Account takeover (ATO) in Retail & e-commerce

How the attack works

1. The operator obtains leaked username and password combinations and tests them against your customer login endpoint. The target is an existing account with reusable credentials, rather than a newly registered identity that has no purchase history.
2. Automated clients distribute attempts across residential proxies. Each address contributes a smaller share of the traffic, while the operator works through the credential list and records which attempts reach an authenticated session.
3. Inside a compromised account, the operator checks for stored payment options, loyalty balances and saved delivery details. Those features can shorten the path to an order because the customer has already supplied information your checkout normally requests.
4. The attacker places orders or redeems loyalty value, then moves to another account when a payment fails or access is interrupted. The genuine customer discovers an unfamiliar purchase, a missing balance or a change they did not make.

Why it gets through

A valid password answers whether the submitted credentials match. It does not establish who is using them. Looking only at successful sign-ins can therefore miss the failed attempts and account switching that preceded a purchase.

An IP limit can interrupt a noisy source, but a distributed campaign divides its attempts across addresses. Tightening that limit across the board can also affect customers sharing a network. You need context beyond the address to distinguish repeated automation from ordinary access.

Rules based on a known request signature can catch the client you have already investigated. The operator can change headers or client configuration and try again. When login and checkout are reviewed separately, the team loses the relationship between credential testing and the later use of stored value.

Chargeback ratio measures the payment damage, but loyalty liability can accumulate separately. Restoring stolen points and handling disputed orders draws on different teams and budgets. A payment that appears valid at checkout can still lead to a complaint after fulfilment.

Account-recovery tickets show the operational cost. Support must verify the customer, restore access and explain what happened. Reviewing each account in isolation makes a campaign look like a collection of unrelated service problems rather than repeated activity with shared context.

Customer retention is the longer consequence. A customer whose saved details were misused may stop trusting the convenience of an account. Payment scrutiny can also increase when compromised accounts repeatedly generate disputes, making the login problem relevant to your payments team.