Glossary

A criminal gaining access to a legitimate user's existing account. The account is real, the owner is real, and the credentials are correct — which is why ATO passes most authentication checks.

Automated testing of stolen username and password pairs across many sites at once, betting on password reuse. Success rates are low, but the tooling is cheap enough that the economics still work.

A username or email address together with its password. Pairs matter more than either half alone — a password is only dangerous attached to the account it opens.

Targeted fraud in which an attacker impersonates an executive, vendor, or partner over email to move money or extract data. Unlike phishing, it often carries no link or attachment to detect.

Running small or zero-value transactions against stolen card numbers to find which are still live, before using the working ones for real purchases.

An account created with a fabricated or assembled identity rather than a stolen one. Nothing about it is reported stolen, so there is no victim to raise a flag.

A fraudulent account created early and left dormant so it looks aged and established by the time it is used. Account age reads as trust to most risk models.

Value taken from one account, laundered through an intermediary, and delivered to a paying stranger who has no idea they are part of the scheme. The final transaction looks entirely legitimate.

Theft of points, miles, or stored value from loyalty accounts. Often detected at redemption, by which point the compromise happened days or weeks earlier at login.

Deceiving a user into surrendering credentials or authentication codes, usually through a message that impersonates a service they trust.

A long-running confidence scam that builds trust over weeks or months before extracting money, typically through a fake investment platform.

Malware that harvests saved credentials, session cookies, and autofill data straight off an infected device — bypassing the login page entirely.

Credentials observed as criminals actively use and test them. Because it reflects current activity, it indicates present risk rather than past exposure.

Credentials recovered from a disclosed breach. Useful, but always behind: a breach must be discovered, processed, and distributed before the data reaches a defender.

Networks and marketplaces where stolen credentials and card data are traded. A source of intelligence, but only after data has already been packaged for sale.

A tool criminals use to validate stolen credentials against a specific site at scale. Observing checker traffic reveals which credentials are being tested against whom, right now.

The leading digits of a payment card that identify its issuer and product. Monitoring a BIN range surfaces testing activity against cards you issued.

The sequence from initial breach through testing, sale, and attack to the victim organisation noticing. Where you intercept it determines how much damage is already done.

Registering an email address and letting it accumulate history before using it, so it presents as an established identity at the moment of onboarding.

Generating many addresses from a single controlled mailbox so one operator can present as many unrelated users.

Checking a credential pair against known-compromised data at login, signup, or password reset, and acting on the result before access is granted.

Assessing the risk attached to an email address itself — whether criminals already control the mailbox, and whether the address has any legitimate history.

Watching your card ranges for active testing so you can raise scrutiny, lock cards, and reissue before fraudulent transactions land.

Continuous surveillance of your domains, BINs, and users, with alerts naming what is being attacked, how often, and how successfully.

Requiring a second proof of identity beyond the password. Effective against some attacks, and routed around entirely by others — particularly when the second factor lands in a compromised inbox.

A short-lived code sent to a user to confirm identity. Its security rests entirely on the channel it is sent through — an OTP to a compromised mailbox protects nobody.

Adding a verification challenge only when a specific signal warrants it, so friction lands on risky sessions instead of every user.

A phishing-resistant credential bound to a device, replacing the password. Strong against credential theft, but account recovery still routes through the email address.

A legitimate user flagged as risky. The cost is real: abandoned sessions, support load, and users who do not come back.