Credential stuffing attacks are an escalating challenge for businesses, exploiting stolen login credentials to access user accounts unlawfully. Levi’s, a global leader in retail, became the target of such an attack in 2024, highlighting the devastating consequences of insufficient defenses against automated threats. FraudGuard.io’s User History API and Rate Limiting API could have provided Levi’s with the proactive tools needed to mitigate and even prevent this breach.

The Attack on Levi’s: A Case Study

Credential stuffing attacks rely on vast databases of stolen credentials to flood login systems with automated attempts. Levi’s faced:

  • Attack Vector: Automated login attempts using stolen credentials targeted their customer accounts.
  • Impact: Unauthorized access to sensitive customer data, damaging trust and Levi’s reputation.
  • Challenges: Inability to differentiate between legitimate users and attackers in real-time, leaving accounts exposed and systems strained.

FraudGuard.io’s User History API is specifically designed to detect and respond to such attacks, providing real-time insights and actionable recommendations to prevent unauthorized access.

1. User History API

A Deeper Dive into User History API Capabilities

The User History API tracks and evaluates user access patterns, offering businesses a detailed understanding of login behaviors and potential threats. This API delivers recommendations in real-time to protect systems from credential stuffing and other automated threats.

Recommendations: Actions and Reasons

When an access attempt is flagged, the User History API offers recommendation actions and recommendation reasons to guide the appropriate response.

Recommendation Actions:

  • Allow: Grant access without restriction for trusted users.
  • Challenge: Trigger additional verification, such as two-factor authentication (2FA) or SMS verification, when potential risks are detected.
  • Block: Deny access entirely for attempts linked to high-risk or suspicious behavior.

Recommendation Reasons:

  1. IP in Whitelist: Trusted IP address, granting seamless access.
  2. IP in Blacklist: Blocked IP due to known risks.
  3. IP in Geoblock: Restricted access based on geographic location.
  4. Unusual Location: Login attempt from a new or unexpected location.
  5. New Device: Access from an unfamiliar device.
  6. Frequent Login Attempts: Repeated access attempts indicating possible brute-force activity.
  7. Bad IP Reputation: Known low-reputation or malicious IP.
  8. Normal Activity: Access consistent with past behavior.
  9. Previous Suspicious Activity: History of suspicious activity associated with the IP or location.
  10. VPN or Proxy Detected: Use of a VPN or proxy, raising the need for further monitoring.

How It Could Have Helped Levi’s:

  • Early Detection: Repeated login attempts from specific IPs could have triggered the Frequent Login Attempts flag, prompting either a challenge or block action.
  • Location Awareness: Login attempts from regions outside Levi’s customer base could have been flagged as Unusual Location, restricting access or requiring 2FA.
  • Device Monitoring: Attackers using new or unexpected devices would have been flagged under New Device, limiting their ability to bypass protections.
  • Reputation Awareness: Bad IP reputation could have immediately blocked access from known malicious sources, cutting off a significant portion of the attack.

By integrating the User History API, Levi’s could have dynamically adjusted their security measures based on real-time threat intelligence, significantly reducing the attack’s effectiveness.

2. Rate Limiting API

Throttling Malicious Login Attempts

The Rate Limiting API prevents credential stuffing attacks by restricting the volume of requests allowed per IP or user in a given timeframe. It ensures that legitimate users can access services without interruption while blocking abusive actors.

How It Could Have Helped Levi’s:

  • Limiting Damage: Automated login attempts from a single IP (or limited number of IPs) would have quickly exceeded rate limits, blocking further access.
  • Protecting Resources: Prevented infrastructure overload, ensuring system stability during the attack.
  • Flexible Rules: Dynamic rate limit adjustments could have restricted attack vectors while maintaining usability for legitimate customers.

Together with the User History API, the Rate Limiting API forms a robust defense against high-volume automated threats.

3. Enhancing Security with FraudGuard.io

FraudGuard.io offers powerful tools to bolster your security infrastructure, ensuring you can detect, prevent, and respond to threats with agility:

  • Rate Limiting API: Throttle suspicious traffic and prevent credential stuffing by setting precise thresholds for login attempts, effectively stopping automated bots in their tracks.

  • User History Check API: Leverage advanced context to identify unusual login patterns, such as new devices or unexpected locations, and respond dynamically by blocking, challenging, or allowing access.

  • Blacklist Support: Attackers should not get multiple chances. After detecting malicious login attempts or credential stuffing activity, these IPs should be immediately blacklisted. FraudGuard.io’s APIs let you easily manage a dynamic blacklist, ensuring persistent attackers are permanently denied access.

  • Geoblocking API: If you don’t do business in a particular country, why expose your systems to risk from that region? With FraudGuard.io, you can block network access from entire countries with a single click. This reduces exposure to international attackers and simplifies securing your infrastructure.

By integrating these FraudGuard.io features into Levi’s systems—or any organization’s infrastructure—the attack could have been detected and mitigated early, reducing risk and preserving customer trust.

Protect Your Business Today

Start your journey to stronger security with FraudGuard.io. We offer a 14-day free trial to explore our tools, including the User History API and Rate Limiting API, and see their impact firsthand.

Sign up today at FraudGuard.io and protect your business from the evolving landscape of cyber threats.