Client
A regional consumer lender with a customer portal and a network of independent loan brokers
Sector
Consumer Finance & Identity Security
Engagement
Login abuse detection, step-up authentication and broker access hardening - multi-quarter programme.
What the client needed
The lender held income, loan-limit and contact details for several hundred thousand customers and for the brokers who arranged their loans. Attackers were replaying passwords from unrelated breaches, but slowly: a few attempts per account, spread over thousands of addresses, timed to look like ordinary traffic. The per-address rate limits never fired, and the first sign was customers ringing to say their details had changed. Recent attacks on lenders in other countries, where stolen logins exposed income and loan data, made leadership ask how long this could already have been going on.
How we worked
- Streamed every login event into one store keyed by account, not by address, and kept ninety days of history so slow campaigns became visible.
- Scored each attempt on signals that are expensive to fake: device continuity, time since the account was last seen, whether the password had appeared in breach corpora, and the pattern of failures across a whole session.
- Added step-up authentication only above a score threshold, so most genuine customers never saw an extra prompt.
- Moved brokers onto phishing-resistant authentication first, because one broker login exposed many customers.
- Replaced per-address throttles with per-account throttles and a short cooling-off on accounts under pressure.
- Gave the fraud team a daily campaign view, grouping attempts into likely runs with the accounts touched, so one decision could protect a whole batch.
Measured results
All figures verified with the client. Account volumes and fraud values withheld in line with our standard confidentiality terms.
- Credential-stuffing campaigns are now spotted within hours, where previously the first signal was a rise in customer complaints days later.
- Account-takeover losses fell sharply in the first two quarters after go-live.
- Only a small minority of genuine logins see a step-up prompt, and support calls about locked accounts did not rise.
- All brokers are now on phishing-resistant sign-in, and the dormant broker accounts found along the way were closed.
- The fraud team plans campaigns by batch rather than by individual complaint.
"We were watching for a flood and the attackers sent a drip. Once we looked at accounts instead of addresses, the drip had a shape, and so did the people behind it. What I value most is that customers did not notice anything changed."
Working on something similar?
If this engagement looks like the kind of problem you are facing, we would be glad to compare notes by email.
Context and constraints
Every extra prompt costs a lender completed applications, so the bar for adding friction was high. The design principle was simple: friction only where the evidence justified it, and nowhere else. We also kept decisions explainable, because a customer locked out in error has to be told why, and a regulator may ask.
Why account-level beats address-level
Attackers with large pools of rented addresses make the address nearly meaningless. The account is the one thing they cannot change, because it is what they are after. Looking at how an account behaves over weeks, including odd gaps and the shape of failures, turned out to be far more reliable than counting hits per address per minute.
Brokers first
We assumed customers were the weak point. The data said otherwise: a handful of broker accounts, with passwords reused elsewhere, could expose far more records than any individual customer. Hardening that channel first delivered the largest risk reduction for the least disruption.
Lessons learned
The first lesson was to keep long history, because slow attacks only appear over weeks. The second was to test thresholds against a month of real traffic before switching anything on. The third was to give fraud analysts the campaign view from day one; without it the scores would have been a number nobody acted on.
If your login controls were designed for the loud attacks, we would be glad to talk. Email sales@halfteck.com.