Identifying security risks and fraud attacks using authentication from a network of websites

A non-transitory, computer-readable medium storing computer-readable instructions executable by a computer and configured to:

• monitor, at a centralized authentication system, login attempts with various sets of credentials at a plurality of websites;
• track counts on a per-credential-set basis of invalid uses of the various sets of credentials across different websites of the plurality of websites;
• evaluate the tracking to determine whether at least one set of credentials used for attempted logins at different websites of the plurality of websites is compromised;
• and
• in response to determining that a first set of credentials is compromised based on the evaluated tracking, automatically initiate at least one protective action associated with the first set of credentials.

A system comprising:

• at least one processor;
• and
• a non-transitory computer-readable storage medium coupled to the at least one processor and storing programming instructions for execution by the at least one processor, the programming instructions instructing the at least one processor to:
• monitor, at a centralized authentication system, login attempts with various sets of credentials at a plurality of websites;
• track counts on a per-credential-set basis of invalid uses of the various sets of credentials across different websites of the plurality of websites;
• evaluate the tracking to determine whether at least one set of credentials used for attempted logins at different websites of the plurality of websites is compromised;
• and
• in response to determining that a first set of credentials is compromised based on the evaluated tracking, automatically initiate at least one protective action associated with the first set of credentials.