Akamai reported that it observed 55,141,782 malicious login attempts against one financial-services firm on August 7, 2019. That striking figure describes a single day in a historical dataset—not confirmed account takeovers and not evidence of a bank-login surge in 2026.
What Akamai found—and when
Akamai’s findings cover activity observed from December 1, 2017, through November 30, 2019. In its February 2020 announcement, the company reported 85,422,079,109 credential-abuse attempts across its observed infrastructure during that period. Of those, 16,557,875,875 targeted identified API hostnames, including 473,518,955 API attempts aimed at financial-services organizations. These are observed attempts, not successful logins or a count of compromised accounts. Akamai’s announcement, republished by PR Newswire
| Finding | What it describes |
|---|---|
| 55,141,782 attempts | Attempts Akamai observed against one financial-services firm on August 7, 2019. |
| 85,422,079,109 attempts | Credential-abuse attempts observed across Akamai’s infrastructure from December 1, 2017, through November 30, 2019. |
| 16,557,875,875 attempts | Attempts against identified API hostnames in that same period. |
| 473,518,955 attempts | API attempts aimed at financial-services organizations in that same period. |
The numbers reflect Akamai’s customer-facing infrastructure and its detection methods, not a global census. Akamai’s report treated unsuccessful login attempts using email-address usernames as credential-stuffing attempts. It described a volumetric method that counted login errors associated with an address, alongside bot detections for known botnets and tools. Distributed botnets can spread activity across targets and time, making simple volume thresholds less likely to catch it. Akamai, Credential Stuffing: Attacks and Economies
Why credential stuffing targets bank logins
Credential stuffing is the automated testing of username-and-password pairs that were previously exposed or stolen. It works because people sometimes reuse passwords: attackers try credentials leaked from one service on unrelated services, including financial accounts. As Akamai put it in its report, “Recycled passwords are why credential stuffing attacks work.” Attackers may also try variations of known credentials, but the core technique starts with pairs they already have; that distinguishes it from simply guessing passwords.
#1 Best Overall
- Power bank design with LCD display, portable and discreet for daily use
- 1080P night vision and motion detection for clear recording day and night
- No WiFi needed, local storage for higher privacy and data security
- Loop recording and long battery life for continuous stable working
- One-button operation, ideal for meetings, home and outdoor recording
Why APIs mattered in the findings
Akamai said credential-abuse attacks against financial services targeted APIs at a rate of up to 75% during the period studied. SecurityWeek reported higher spikes—above 80% in May 2019 and above 75% in October 2019. Those figures describe 2017–2019 observations and should not be read as the current share of attacks. Akamai said it saw a sharp shift toward API endpoints beginning in May 2019, potentially as attackers sought to bypass defenses. It also noted a separate API-focused run of more than 19 million credential-abuse attempts on August 25, 2019. Akamai’s February 2020 announcement · SecurityWeek’s February 21, 2020 report
In Akamai’s analyzed login mix, traditional username-and-password logins made up 74%, as reported by SecurityWeek. This is a measure of the login mix in that historical analysis, not a claim about the authentication methods banks use today. SecurityWeek also reported separate financial-services web-application attack categories for the period: 47% Local File Inclusion, 36% SQL injection, and 7.7% cross-site scripting. Those are web-application attack categories, not credential-stuffing login counts.
Rank #2
- This security camera features a minimalist design, while housing a built-in HD imaging system. Its seamless build blends naturally into any environment—whether placed on a desk, in an entryway, or by a bedside—making it ideal for everyday home or office use.
- Equipped with a 1080P Full HD image sensor and adaptive low-light technology, it captures clear video and still images day and night. With built-in motion detection, the device automatically starts video capture and takes a snapshot when movement is detected, sending instant alerts to your phone via the dedicated app.
- The built-in battery supports continuous monitoring. Perfect for travel, home office, or daily use, it meets both your charging and peace-of-mind needs at once.
- Using the dedicated app (compatible with iOS and Android), you can view live video anytime. In addition to local microSD storage (up to 256GB), optional cloud backup (subscription required) keeps your footage secure—even if the device is lost or damaged.
- Setup is plug-and-play—no complicated installation required. It can run 24/7 as a plugged-in monitor or switch to motion-activated mode. The intuitive app lets you customize settings to fit different scenarios smoothly.
What the historical surge headline does—and does not—mean
The figures explain why a February 2020 headline described fraudulent login attacks against banks as surging: Akamai observed enormous volumes of credential-abuse attempts, including a very large one-day event and substantial API targeting. But the dataset ended on November 30, 2019. It cannot establish a current surge, the present-day rate of bank login attacks, or the defenses deployed by any specific bank.
SecurityWeek quoted Akamai security researcher and report co-author Steve Ragan saying, “Criminals are getting more creative and hyper-focused on how they go about obtaining access to the things they need to conduct their crimes,” and that criminals targeting financial services “pay close attention to the defenses used by these organizations, and adjust their attack patterns accordingly.” Those remarks describe the report’s historical context, not a verified 2026 trend.
Rank #3
- Discreet Utility Design: Disguised as a standard power bank, this device houses a camera with a wide-angle lens for covert video recording.
- Lightweight & Easy to Use: Only 130g, size 4.13×2.68×0.59 inches—small enough to put in your pocket.
- Wireless + TF Card Storag: It’s wireless—no messy wires! You can insert a TF card (max 256GB, not included) to store videos. Works with WiFi for remote viewing, or use it directly with a TF card without WiFi.WIFI connection only supports a single channel of 2.4GHz
- Compatibility duration: This charger can seamlessly blend into the modern environment. It is highly suitable for daily use at home, in the office, or during travel. It can be used continuously for 22 hours.
- After-sales service: We will handle and resolve your issue within 8 hours after receiving your feedback.
What banks and account holders can do
For financial-services security teams
The findings point to the need to consider API authentication paths alongside browser-based login pages. Akamai’s methodology also illustrates why defenses based only on request-volume thresholds can miss activity spread across targets and time. Useful evaluation questions include:
- Does monitoring cover both API and web login endpoints?
- Can detection identify automated traffic beyond simple request-volume thresholds?
- Can the system surface distributed or low-and-slow attempts?
- Do authentication options support strong additional checks, including multifactor authentication?
The historical report does not benchmark specific products or establish that one control would prevent every attack.
For bank customers
Use unique passwords for financial accounts rather than reusing a password exposed on another site, and enable multifactor authentication (MFA) when your financial institution offers it. CISA’s archived “More than a Password” guidance recommends MFA for financial-services accounts because an additional authentication requirement can help protect an account if its password is compromised. CISA, “More than a Password”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
