Credential stuffing is, first and foremost, a user issue. There’s only so much you can do when people use the same password for all their different websites.

That being said, there are some “above and beyond” steps a platform can take and most companies definitely don’t.