system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5 Brute Force password attacks; wouldn’t they get locked out?

I understand how password length and character exponentially increases the time necessary to brute force the answer. 

Question is how do the attackers get around all the various hurdles and lockouts that every site seems to have?  If they don’t have some trick for getting around the lockout, wouldn’t the account just get locked within the first few tries and they’re done?

Wouldn’t somebody on the backend notice all the attempts?
gpt
Generally speaking, people aren't brute forcing passwords by shoving them into a webform.

Instead, here's what will usually happen.

First, years ago you will have signed up for some random website that has moderate security at best. The email address and hashed password are part of that site's database.

Then, that site gets exploited in some way, and that database of emails and hashed passwords is made available for the right price.

Then, someone buys that database and starts cracking passwords. They try password after password until they can match what's in the database. There's no lockout system here, since that's a software layer put in top by the website that would normally be using this database.

After they've cracked enough passwords, they'll sell known email/password combinations. Other people will try those email/password combinations on other websites, hoping that you reused the same password in multiple locations.