Dissuading stolen password reuse

A system comprising:

• at least one data processor;
• and
• memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
• initiating, by a software application executing on a primary server, a user authentication process prompting a user to enter, via a graphical user interface, login credentials;
• determining that the login credentials have been flagged;
• injecting, in response to the determining, tracking cookies on a computing device used by the user;
• creating, using information obtained from the injected tracking cookies, a virtual profile of the user, the virtual profile comprising a list of password trials per website, timestamps for password trials, and an origin of at least one stolen password;
• directing the user from the primary server to a fake server mimicking the software application executing on the primary server;
• initiating an account password recovery process requiring multi-factor authentication;
• prompting, in the graphical user interface, the user to provide an e-mail address and/or phone number required for the multi-factor authentication, the provided e-mail address and/or phone number forming part of the obtained metadata;
• obtaining, by the fake server and based on the virtual profile, metadata associated with the user interacting with the fake server that characterizes the user including the e-mail address and/or phone number provided by the user in response to the prompting;
• and
• providing data comprising the obtained metadata.

A non-transitory computer program product storing instructions which, when executed by at least one data processor forming part of at least one computing device, result in operations comprising:

• initiating, by a software application executing on a primary server, a user authentication process prompting a user to enter, via a graphical user interface, login credentials;
• determining that the login credentials have been flagged;
• injecting, in response to the determining, tracking cookies on a computing device used by the user;
• creating, using information obtained from the injected tracking cookies, a virtual profile of the user, the virtual profile comprising a list of password trials per website, timestamps for password trials, and an origin of at least one stolen password;
• directing the user from the primary server to a fake server mimicking the software application executing on the primary server;
• obtaining, by the fake server and based on the virtual profile, metadata associated with the user interacting with the fake server that characterizes the user;
• and
• providing data comprising the obtained metadata.