Another Breach, Another Instance of Weak Passwords Causing in Account Takeover

by Guest Contributor 3 min read July 24, 2014

Your password is weak, whether you use 40 random characters or your dog’s name. With so many large data breaches leading to hundreds of millions of compromised credentials and payment cards in the past two years, it’s no surprise that e-commerce account takeover attempts have grown dramatically in recent months – to a degree we have never seen before. Previously, account takeover was primarily a banking issue, not something merchants had to deal with.

Account takeover is an alarming trend that spans global airline loyalty programs, e-commerce transactions, social networking logins and virtually any web site leveraging username and password authentication. News of the latest cybersecurity concern should serve as yet another reminder that we live in a heightened state of risk where establishing online trust based solely on username and password or identity data is not sufficient. There are a number of factors that are contributing to the evolving fraud landscape namely that the Internet was not designed for security. This places pressure on organizations to continually adopt new approaches to managing fraud like this growing account takeover threat. In this case, multiple layered controls including device intelligence are essential.

As merchants extend more services online and allow customers to store payment information or get more convenient checkout via logged in vs. guest access, we’ll continue to see fraud migrating deeper into the e-commerce ecosystem. The account takeover problem will continue as consumers share usernames and passwords across dozens of online profiles and e-commerce logins, opening the door for attackers to access multiple accounts through a single compromised credential. Most of the account portals used by e-commerce merchants and loyalty programs were not built with the same level of security that their online transaction and fraud management systems have in place. So it’s a bit of a new risk, but fraudsters are aggressively exploiting the security gaps around things like simple username/password authentication.

What can consumers and organizations do to protect themselves?

Our recommendation for consumers is that they have unique username and password combinations for every online profile. This protects against attackers compromising one site and leveraging the same credentials to access all of the victim’s accounts and online profiles across the web. For businesses, we recommend implementing technology solutions that increase visibility to and recognition of devices for every online interaction so the organization can differentiate attackers from legitimate consumers. Some businesses believe that their products, services and loyalty offerings do not require the same level of protection as online bank accounts, so they leave them exposed to cyber criminals via simple authentication controls. As we’ve seen fraudsters will migrate to the path of least resistance and exploit the fact that most consumers re-use credentials out of convenience.

In the digital age where consumers are increasingly represented by their devices the ability to know when there are authentication discrepancies between the data presented by the user and the device presenting those credentials is absolutely important to effectively controlling the threat. The authentication process will shift from a single view to a layered, risk-based authentication approach that will include comprehensive and real-time updates of consumer information.

Conversations around the fact that the password is dead or dying have been circulating in the industry recently. What we don’t want is consumers getting tired of constantly changing passwords and giving up trying to protect themselves online. That is the worst case scenario that is becoming more of a reality as the days pass. Educated and aware consumers are still the best way to identify fraudulent attacks, and to keep identity data safe from hackers and devices free of malware.

Increased adoption of biometrics, device intelligence and the sharing of authenticated and credentialed identities across industries will become commonplace to help combat account takeovers as they increase. Until then we need to find a password replacement.

Learn more about 41st Parameter fraud detection and prevention solutions here.

Related Posts

2026 Fintech Identity and Fraud Report

Explore the Fintech Identity and Fraud Report for insights on AI-driven fraud threats, identity protection and the evolving fraud landscape.

September 28, 2026 by Laura Davis
Who’s Driving What? How Fuel Loyalty and Generational Preferences are Shaping the Vehicle Market

Take a look around at any road, parking lot, or highway, and you’ll see just how diverse today’s vehicle landscape has become. Within that evolving mix, electric vehicles (EVs) have seen years of rapid growth, and while the market is seemingly entering a new phase, interest remains. So, with several vehicles and fuel types to choose from, what keeps drivers coming back to electrified vehicles? Experian Automotive’s Automotive Market Trends Report: Q2 2026 found that among EV owners who returned to the market in the last 12 months, majority (72.2%) replaced their EV with another EV, while 18.5% switched to a gasoline vehicle. Hybrid buyers also showed considerable loyalty to electrification, with 55.7% of gas-hybrid owners staying with the same fuel type when replacing their vehicle, and 32.7% swapping for a gasoline vehicle. Consumers are seemingly remaining loyal to EVs and hybrids because they are attracted to the benefits that fit their everyday lifestyle, such as lower fuel or charging costs amid the elevated gas prices. For some, it could also be tied to convenience, as drivers who have found a reliable charging routine or appreciate the efficiency of a hybrid may have little reason to switch back to a traditional gasoline vehicle. Generations are taking different paths to electrification Generational differences also influence hybrid and EV loyalty, with younger consumers generally showing greater openness to alternative fuel types. While older generations tend to have greater familiarity with traditional gasoline vehicles, hybrid and EV adoption is increasing across all age groups as these options become more accessible and mainstream. Millennials, in particular, showed the strongest inclination toward electrified vehicles. Through Q2 2026, they accounted for the highest EV share at 8.2%, compared with Gen X at 5.5%, Gen Z (4.7%), and Baby Boomers (4.7%). The difference becomes even more pronounced when hybrids are in the mix, as 23.1% of Millennial registrations were gas-electric hybrids or plug-in hybrids, versus 16.7% for Gen X, 16.8% for Gen Z, and 18.0% for Baby Boomers. For automotive professionals, these differences make understanding who is driving what, and what they may choose next, increasingly important. The future of the automotive market may be less about consumers choosing one vehicle type over the other and more about understanding the distinct patterns and preferences of each generation. As the market continues to evolve, those insights can help automotive professionals better meet consumers where they are. To learn more about vehicle market trends, view the full Automotive Market Trends Report: Q2 2026 presentation on demand.

September 24, 2026 by John Howard
New Data Available for MBS Investors: Current Credit Score 

In a previous post, we described how every mortgage borrower’s financial situation and credit profile evolve over time.  After a borrower opens a loan, their financial status evolves—jobs are gained and lost; incomes can rise or fall, and financially stressful situations or windfalls can occur. These effects are often reflected in the consumer’s evolving credit score, which changes with the consumer’s payment behavior on open loans, credit inquiry activity, credit card utilization, and other revolving lines, among other things.    Even though MBS, whole loan, and MSR investors ultimately bear borrower credit risk, they may have access to less current borrower credit information than other participants in the mortgage ecosystem.   In securitized markets (both agency MBS and private-label MBS), updated scores are not provided in disclosure to bondholders, even as loans age year over year.  In whole loan and MSR markets, a single origination credit score is often provided at the time of bid, and after a successful bid, the investor may have a permissible purpose to pull individual scores on an owned portfolio. But until recently, there was no single loan-level dataset that included continuously refreshed credit scores across the U.S. mortgage market—the type of foundational dataset needed to build and tune credit and prepayment models.  A monthly-refreshed Current Credit Score field meets our three-pronged materiality standard for new data delivery to MBS markets:  New: Provides information not available in existing datasets (i.e., orthogonal to currently available data). Neither private-label MBS nor agency MBS standard market data includes a monthly-refreshed borrower credit score.  Material: Impacts a sizeable portion of the MBS universe. For the vast majority of loans in MBS, borrowers credit scores are available.  Significant: Differentiates collateral performance by a large enough margin to influence trading and risk management decisions.  A current credit score wraps all of a borrower’s credit-related behaviors into a single numerical value and has historically been associated with a borrower’s likelihood of becoming 60+ days past due on any obligation within the subsequent 24 months.    In fact, a current credit score is among the most informative indicators of near-term mortgage default risk, as shown in the image below, which depicts 30+ DPD rates by current credit score bands for the entire U.S. mortgage market, controlling for origination score <=650.    Without access to current credit scores, investors are limited to the score at origination—causing the four distinct performance trends shown here to appear as a single averaged line. In reality, score migration since origination reveals significant divergence in credit risk, with the lowest current-score bucket exhibiting a nearly 10 times higher 30+ DPD rate than the highest-score bucket in the latest period shown.  Source:  Experian Mortgage Loan Performance (MLP) dataset hosted on IVolatility DataDriven Platform  In this article, we’ll take a quick look at how score migration acts as an early predictor of a performing loan’s first roll into 30-day delinquent status.    MBS Investors’ Current Credit Score Blindspot: Solved   An MBS investor relying on standard market data and securitization remittance reports sees no sign of borrower stress until the subject mortgage loan in the securitization misses a payment and is reported at 30 days delinquent. Of course, in the vast majority of cases, a borrower begins struggling financially well before missing a mortgage payment:  The borrower may miss payments on other types of loans (credit card, auto loan, personal unsecured, or payday loans) as they prioritize their home and mortgage.  Outstanding balances on credit cards may grow as the borrower begins to make only minimum payments on revolvers.  The borrower may apply for additional credit cards, personal or payday loans   The borrower may apply to increase limits on existing credit cards as outstanding balance nears spending limit  All these stress-indicative behaviors result in a decreasing credit score, many months before the borrower misses their first mortgage payment. An MBS investor with access to each borrower’s current credit score, refreshed each month, can predict increased likelihood of default many months before the first missed mortgage payment—and is therefore at a major information advantage relative to the market generally.  Experian’s Mortgage Loan Performance (MLP) dataset contains thousands of fields describing mortgage performance from each borrower, loan, and property perspective, all refreshed monthly (including, amongst other things, new credit scores and refinance inquiry activity, loan performance on all types of debt, filed junior liens, and AVM values).   MLP is much more comprehensive than loan-level data provided by Freddie Mac, Fannie Mae, Ginnie Mae, and PLS data vendors in several ways:   Standard market datasets may not contain certain data elements that some market participants consider useful when evaluating mortgage prepayment or credit performance. Basic, critical fields such as the borrower’s current credit score and the current junior lien balance on the property are missing.    MLP contains borrower, loan, and property data fields spanning a broad portion of the mortgage universe, including Agency, Non-Agency, and Esoteric mortgage products (CES, HELOC, Reverse), including both securitized and non-securitized loans.   MLP enables full three-dimensional (borrower + loan + property) tracking with persistent keys for borrower (before and after refinancing), loan (in securities/deals even after exit due to payoffs or buyouts, including before and after MSR sales), and property.  This enables end-to-end analysis of each borrower’s (and property’s) mortgage experience throughout their credit lifecycle.  Is Downward-Trending Credit Score a Signal for Impending Delinquency?  MLP contains thousands of fields describing each loan, borrower, and property across all U.S. mortgages.  It allows for virtually unlimited segmentation and granular analysis.   For purposes of this illustrative article, we’ll take a high-level look at the entire U.S. mortgage market and perform a quick analysis to confirm intuition that a declining credit score provides a signal for higher likelihood of near-term mortgage delinquency.  Figure 1 illustrates the current pay status (as of 6/30) for the entire U.S. mortgage market, as contained in the MLP dataset, along with count, UPB and UPB-weighted Vantage 4.0 credit score for each bucket.  Figure 1  Source:  Experian Mortgage Loan Performance dataset  As illustrated in Figure 1, approximately 772,000 individual mortgage loans were reported to Experian as 30 days delinquent as of 6/30/2026.  Of the 772,000 30d delinquent loans in the June snapshot, approximately 426,000 were current in the prior (May) snapshot.  Some of these 426,000 loans were reperformers which had been bouncing from 30 DPD to current over the prior few snapshots. To remove reperformance score noise, we further parsed out the population which: 1) had rolled from current to 30 DPD from May to June; and 2) was consistently current for a full year prior to the 6/30 missed payment.  The population meeting both conditions totaled approximately 123,000 loans.  Figure 2 below shows, for this population of 123,000 “clean current” loans, the UPB-weighted average Vantage4 credit score for each of the 12 months leading up to the June missed payment, as well as the impact of the missed payment on the 6/30 score.  Figure 2  Source:  Experian Mortgage Loan Performance Dataset  Figure 2 reveals a rather slow and steady ~20-point deterioration of score in the 12 months prior to first missed payment – as well as the 80-point drop once the missed payment hits.  When we compare this cohort’s Vantage 4.0 score trend to the broader Current population across the entire dataset in Figure 3, we see a marked difference in both absolute value and trend:  Figure 3  Source:  Experian Mortgage Loan Performance Dataset  Not only is the cohort’s starting Vantage 4.0 score lower than the broader current population, but it also displays a dropping trend (with a notable 2 to 3x acceleration in monthly score drop the month before the first missed mortgage payment) while the broader Current population’s score (of which the isolated cohort is a subset) remains rock steady.  Lastly, we present Figure 4, a histogram comparing the distribution of at-origination and as-of 5/30 (i.e., the period just before the missed June mortgage payment) credit scores for the clean current population. The distribution appears to shift toward lower credit scores. To the extent credit scores are correlated with credit risk, this shift may indicate elevated credit risk relative to origination. Since this degradation occurs during a period of perfect mortgage pay performance, it is invisible to MBS investors who lack access to current borrower credit scores. Experian MLP provides monthly refreshed credit scores for mortgage borrowers contained within the MLP database.  Figure 4  Source:  Experian Mortgage Loan Performance Dataset 

September 22, 2026 by Michael Pyatski, Perry DeFelice

Subscribe to our Newsletter

Enter your name and email for the latest updates.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Subscribe to our Newsletter

Don't miss out on the latest industry trends and insights!
Subscribe