How account recovery gets used against you

Every account has a back door, and it is there on purpose: the route that lets you back in when you have lost the password, the phone and the laptop. It has to work under the worst conditions. That is what makes it the softest target on the account, and why an attacker who cannot guess your password will often go for the reset flow instead.

How the attack actually runs

The attacker rarely starts with your password. They start with the reset form, and work out what it will accept as proof that they are you.

Historically that proof was a security question, which is why NIST now prohibits verifiers from prompting for knowledge-based authentication at all. The answers — your mother’s maiden name, your first school, your first car — are not secrets. They sit in public records, on social profiles, and in old breach data.

Where the reset sends a code to a phone number, the attack shifts to the number itself. CISA lists SIM swap alongside phishing and SS7 as reasons SMS sits at the bottom of its four-tier MFA ranking. Get the number ported, receive the code, own the account. NIST’s response is to require verifiers to watch for exactly these indicators: device swap, SIM change, number porting.

Where the reset sends a link to a secondary email, the attacker goes after that mailbox first. Often it is an old address nobody has looked at in years.

What gives it away

• A password reset email you did not request. One is worth investigating; a series means someone is working on you.
• A verification code arriving unprompted, especially with a message urging you to read it out to ‘support’.
• Your phone losing signal and staying without it, with no outage in your area. That is what a completed port looks like from your side.
• A sign-in notification from a place or device you do not recognise.
• An account quietly changing its recovery address or phone number — usually the first thing an attacker does after getting in, to lock you out of your own reset flow.

If it has already happened

1. Start with the email account, whatever else was taken. It is the reset route for everything else, and until it is secure, nothing you fix downstream stays fixed.
2. Change the password and then revoke active sessions or sign out all devices — a password change alone does not always end a session already in progress.
3. Check the recovery settings before you move on: recovery email, recovery phone, trusted devices, app passwords, and any forwarding rules or filters that were added.
4. Contact your mobile carrier if your phone lost service unexpectedly, and ask about a port-out or SIM-change lock on the account.
5. Then work through the accounts that use that email address for resets, in order of what they unlock.

Where to report it

Report credential theft and account compromise to the FBI’s Internet Crime Complaint Center at IC3.gov. Report fraud carried out with your stolen credentials to the FTC at ReportFraud.ftc.gov.

If it has progressed to identity theft — accounts opened in your name, charges you did not make — go to IdentityTheft.gov, which produces a personalised recovery plan rather than just taking a report.

Setting recovery up so it is not the weakest link

Backup codes are the answer to most of this. A set of one-time codes, generated when you enable a second factor, printed and stored somewhere physical, gives you a recovery route that does not depend on your phone number or an old mailbox. Nobody can SIM-swap a sheet of paper in a drawer.

Store them away from the device and away from the vault they would be used to recover. A screenshot in your photo library defeats the point, since your photo library syncs to the account you are trying to protect.

Where a service lets you remove SMS as a recovery option once a passkey and backup codes are in place, remove it. NIST requires verifiers to offer alternatives to phone-based authentication precisely because it is restricted.

And leave the security questions blank where a site still offers them, or fill them with generated nonsense stored in your password manager. They are not a memory aid; they are an unlockable door.

Sources: NIST SP 800-63B-4, Digital Identity Guidelines · CISA — implementing phishing-resistant MFA · FBI Internet Crime Complaint Center · FTC ReportFraud · FTC IdentityTheft.gov

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from NIST, CISA, the FBI and the FTC. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.