All tabletop exercises
Identity·Starter·Mixed audience
Credential stuffing empties loyalty-points balances
The prompt — read this to the room
Customer support at your 300-store grocery and pharmacy chain has logged 900 complaints in two days: loyalty points gone, redeemed for gift cards online and at self-checkout. Login traffic to the loyalty app is twelve times normal, mostly from residential proxy addresses, with a success rate of about 2%. That is roughly 18,000 accounts accessed. Points are not money in your accounts, but customers treat them as money, and the accounts also hold home addresses and pharmacy pickup history. Marketing launches a double-points promotion on Monday. What do you do first?
Total duration
1 h 15 min
People to involve
6
Best fit
Retail
Who to involve
Most important first.
- CISO / Head of security
- SOC analyst
- Customer support
- Privacy officer / DPO
- Communications / PR
- CFO / Finance
What it tests
- Recognise credential stuffing and choose proportionate controls (rate limits, bot defences, forced resets)
- Decide on reimbursement of points and who owns the fraud loss
- Determine whether account access is a reportable personal-data breach
- Give support a script and a fast path for affected customers
Outline of activities
- 1Complaint spike and login telemetry
- 2Stopping the stuffing without locking everyone out
- 3Is this a data breach? Addresses and pharmacy history
- 4Restoring points and customer trust
- 5Promotion go/no-go and lessons
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…