Most, if not all hackers take over accounts because of guessing a password. They have plenty of time on their hands to guess that one magic set of characters that hands them the keys to the kingdom.
Because of the completely state-less nature of these servers, every guess by a Hacker can be made to look absolutely new. For the Hacker, the whole setup costs next to nothing.
What if we could put a price on each password submitted to the server? Let me explain with and example. Say a user Foo has an account with a bank called Cayman National Bank: Username foo Password bar.
One fine Tuesday the Bank says, "Anyone who wants to submit a password for foo will have to pay $100.00 for mere act of submitting credentials. This includes Foo as well". Foo is now ready to throw a tantrum, "Thats ridiculous", she begins. "Pay to get into my own account?"
Calm down Foo, this next part you will like, the Bank continues, "Once the payment and credentials are verified, the logged-in user can sweep all money collected because of previous unsuccessful attempts into his or her bank account."
So the big idea is to make the guessers pay up cold cash for each unsuccessful attempt. Super whacky? Turns out PayPal is basically in the sweetest spot to build this out! Here is a demo in Production!