Given the rise in data breaches, combinations of usernames and passwords are readily available on the web to be exploited for fraudulent reason via automated Account Takeover tools. https://www.netacea.com/white-papers-and-guides/waf-vs-account-takeover/