Another Breach, Another Instance of Weak Passwords Causing in Account Takeover

Updated: June 12, 2026 by Guest Contributor 3 min read July 24, 2014

Your password is weak, whether you use 40 random characters or your dog’s name. With so many large data breaches leading to hundreds of millions of compromised credentials and payment cards in the past two years, it’s no surprise that e-commerce account takeover attempts have grown dramatically in recent months – to a degree we have never seen before. Previously, account takeover was primarily a banking issue, not something merchants had to deal with.

Account takeover is an alarming trend that spans global airline loyalty programs, e-commerce transactions, social networking logins and virtually any web site leveraging username and password authentication. News of the latest cybersecurity concern should serve as yet another reminder that we live in a heightened state of risk where establishing online trust based solely on username and password or identity data is not sufficient. There are a number of factors that are contributing to the evolving fraud landscape namely that the Internet was not designed for security. This places pressure on organizations to continually adopt new approaches to managing fraud like this growing account takeover threat. In this case, multiple layered controls including device intelligence are essential.

As merchants extend more services online and allow customers to store payment information or get more convenient checkout via logged in vs. guest access, we’ll continue to see fraud migrating deeper into the e-commerce ecosystem. The account takeover problem will continue as consumers share usernames and passwords across dozens of online profiles and e-commerce logins, opening the door for attackers to access multiple accounts through a single compromised credential. Most of the account portals used by e-commerce merchants and loyalty programs were not built with the same level of security that their online transaction and fraud management systems have in place. So it’s a bit of a new risk, but fraudsters are aggressively exploiting the security gaps around things like simple username/password authentication.

What can consumers and organizations do to protect themselves?

Our recommendation for consumers is that they have unique username and password combinations for every online profile. This protects against attackers compromising one site and leveraging the same credentials to access all of the victim’s accounts and online profiles across the web. For businesses, we recommend implementing technology solutions that increase visibility to and recognition of devices for every online interaction so the organization can differentiate attackers from legitimate consumers. Some businesses believe that their products, services and loyalty offerings do not require the same level of protection as online bank accounts, so they leave them exposed to cyber criminals via simple authentication controls. As we’ve seen fraudsters will migrate to the path of least resistance and exploit the fact that most consumers re-use credentials out of convenience.

In the digital age where consumers are increasingly represented by their devices the ability to know when there are authentication discrepancies between the data presented by the user and the device presenting those credentials is absolutely important to effectively controlling the threat. The authentication process will shift from a single view to a layered, risk-based authentication approach that will include comprehensive and real-time updates of consumer information.

Conversations around the fact that the password is dead or dying have been circulating in the industry recently. What we don’t want is consumers getting tired of constantly changing passwords and giving up trying to protect themselves online. That is the worst case scenario that is becoming more of a reality as the days pass. Educated and aware consumers are still the best way to identify fraudulent attacks, and to keep identity data safe from hackers and devices free of malware.

Increased adoption of biometrics, device intelligence and the sharing of authenticated and credentialed identities across industries will become commonplace to help combat account takeovers as they increase. Until then we need to find a password replacement.

Learn more about 41st Parameter fraud detection and prevention solutions here.

Related Posts

Rethinking Charged-Off Portfolio Prioritization

Experian’s new Recovery Scores model turns portfolio intelligence into more focused recovery strategies, helping organizations improve returns, direct effort and accelerate speed to cash. The challenge isn’t simply working more accounts. Whether a debt buyer is evaluating an acquisition, an agency is deciding where to assign collector time or a lender is managing its own post-charge-off accounts, the question is similar: How can limited capacity be directed toward accounts with the greatest potential for recovery? Prioritizing accounts mainly by age, balance or when they were last worked may not show which ones are most likely to generate a recovery. With the new Recovery Scores model, organizations can rank charged-off accounts by expected collectability, providing a consistent signal to inform placement strategy and treatment decisions across the recovery lifecycle. Make collector capacity a strategic resource Working every account with the same level of attention isn’t always practical. The more useful question is: Where should teams focus first to protect speed to cash? Our model performance analysis found: 80% of recovered dollars come from the top 40% of accounts worked. The value isn’t simply a better ranking. It’s how organizations can use it for collections optimization. Score bands can inform different strategies for placement, outsourcing, auction and legal channel treatment rather than applying the same approach across an entire portfolio. For debt buyers: The scores can inform acquisition pricing and how a newly purchased portfolio is divided across internal collections, legal channels and resale. Expected collectability can shape debt portfolio analysis, including how a portfolio is valued and segmented before collection work begins. For agencies: Score bands can help teams focus collector resources on accounts with stronger recovery potential. For first-party lenders: Managing recovery internally, the scores provide another signal to help structure decisions about which accounts to work and in what order. Look beyond collectability alone Prioritization rarely comes down to a single variable. Consider two accounts that both rank highly for expected collectability, but one has a substantially larger balance. Their recovery likelihood may be similar, but the potential dollars recovered are not. The Recovery Scores model uses debt collections analytics by combining Experian’s bureau-based score with current balance information. This helps organizations consider both the likelihood of recovery and the potential dollars at stake, while sensitive balance information remains within the organization’s working environment. Monitor accounts as they change The first decision about an account is rarely the last. Teams continually make choices about treatment, placement and resource allocation as accounts move through the recovery process. Recovery Scores is also available as a trigger. When underlying information changes, teams can receive an update and reconsider an account’s placement without waiting for the next portfolio-wide re-score. An account that shows lower recovery potential today may have a different recovery outlook later. Turn recovery potential into a portfolio strategy When portfolios contain more accounts than teams can work at once, the question isn’t simply, “How many accounts can we work?” It is, “Where can our resources have the greatest impact?” The latest Recovery Scores model helps organizations sharpen placement and treatment decisions. It gives debt buyers a way to price and segment portfolios with greater confidence and gives lenders another tool to direct limited collector time across their own post-charge-off portfolios. Learn more about Experian Recovery Scores

November 10, 2026 by Zohreen Ismail
What Is a Third-Party Breach? How to Prepare for and Respond to Vendor Incidents

Learn what a third-party breach is and steps to prepare, contain risk, and support affected customers. Read more!

November 9, 2026 by Laura Burrows
Mortgage Underwriting Moves from Modernization Talk to Action 

Mortgage underwriting is entering a new phase. In a recent conversation with HousingWire’s Allison LaForgia, Michele Bodda, Group President of Experian Housing, Verification Solutions, and Employer Services, discussed how modern credit scores, alternative data and verification tools are changing how lenders evaluate borrowers.  Lenders can now judge modernization by its results, Bodda said. “Now we’re actually letting more modern scores get into underwriting to help price loans and go all the way through to securitization,” she told HousingWire. “We’re letting the scores and the data actually speak for itself instead of just talking about it.”  The Right Data at the Right Time  Modernizing underwriting means providing useful information at the right stage, rather than giving lenders everything at once. “You don’t need everything all at once. You don’t need everything on initial pull,” Bodda said.  Alternative data, such as rental payments and buy now, pay later activity, can help show how consumers manage obligations, especially those with thinner credit files. A thin credit file does not necessarily mean someone has a thin financial life.  “It’s our responsibility as one of the primary data providers to make sure we can make all of that available, so that we’re best representing the consumer,” Bodda said. A fuller view of data may help lenders identify creditworthy applicants who might otherwise be difficult to assess.  Simplifying Verification and Reducing Friction  Bodda also shared how Experian is making credit information more easily accessible and reducing unnecessary costs during the originations process, explaining that new enhancements to Experian’s Power Profile Plus allow lenders to pull credit data at the start of underwriting and request another score later without repurchasing the data.  “You can pull it later and not pay for the credit data again,” Bodda said.   Experian is also investing in income and employment verification, including through a new partnership with Workday. Bodda explained that Experian will continue to focus on process improvement, competition and innovation across the mortgage ecosystem.  A Broader Path to Homeownership  As consumer expectations and underwriting capabilities evolve, borrowers want a process that reflects their financial lives, while lenders seek greater efficiency. Modern scores, relevant data, and streamlined verification can help lenders assess applications with more context—and may help more people pursue homeownership.  “If we as an industry can open this up and bring more people into the process, then we’re going to thrive,” Bodda said in the interview.   Watch the interview and hear all of Michele’s insights, and more here.  

November 6, 2026 by Caroline Basile

Subscribe to our Newsletter

Enter your name and email for the latest updates.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Subscribe to our Newsletter

Don't miss out on the latest industry trends and insights!
Subscribe