Home / Knowledge hub / Credential recovery
Knowledge hub
Credential recovery
The ways a locked-out user gets back in, which are often the weakest door.
What it means
Credential recovery is every route a person has back into an account when they have lost the means to sign in: a password reset email, a text message code, a backup code, security questions, or a request to support. Each one is a second way in.
An account is only as strong as its easiest route. A good password and MFA mean little if a reset link can be guessed, or a support agent can be talked into changing the email address.
Why it matters
Attackers go to recovery because it is designed to work without the secret. Account takeover through a reset is common, and it bypasses any stronger sign-in beside it. The loss is the account, plus whatever sits behind it: orders, files and stored payment details.
Locking people out has a cost too. A recovery process that is too hard drives support calls and abandoned accounts. The aim is a route that works for the owner and is hard for anyone else.
How it shows up
You meet it in forgot-password pages, email change forms, phone number changes, backup codes and support desk procedures. NIST digital identity guidance advises against security questions, because answers are often easy to find or guess.
The mistakes repeat. Reset tokens are short or reusable. A reset signs the user in and skips MFA. The response reveals whether an address has an account. Changing the email needs no current password. Support resets on a phone call alone. Check each route for the same strength as sign-in itself.
Questions people ask
Credential recovery, answered
Why is account recovery so often attacked?
Because it is built to work for someone who has lost their credentials, an attacker pretending to be that person looks the same. If recovery is weaker than sign-in, it becomes the preferred path.
The strongest sign-in protects nothing if recovery is easy.
Are security questions safe?
Not really. Answers are often found on social media or guessed, and they rarely change. NIST's digital identity guidance advises against knowledge-based questions for this purpose.
Prefer a time-limited link or code sent to a verified channel.
Should a reset link bypass MFA?
No. A reset should prove access to a verified channel, then still require the second factor, or at least apply extra checks and notify the owner. Otherwise MFA can be switched off by anyone who can read the email.
Flag the change through every contact route.
How do we protect support-led recovery?
Give agents a written identity check, require a second approver for high-risk changes, log every action, and notify the account's existing contact details afterwards.
Social engineering of support is a routine route to account takeover.
What should we test?
Check token strength and lifetime, single use, rate limits, whether error messages reveal accounts, whether the email address can be changed without re-authenticating, and whether old sessions end after a reset.
See password reset flaws.
Related
Terms that sit next to this one
Password reset flaw
A weak reset link or code that lets someone else take over the account.
Account takeover
An attacker ends up signed in as one of your real users.
2FA bypass
Getting past a second sign-in step by exploiting how it is built or enforced.
Account enumeration
Learning which emails have accounts because your app answers differently.
Magic link
A sign-in link sent by email that replaces the password for that visit.
How strong is your way back in?
Recovery routes are checked as part of our testing, and each flaw is proven by exploiting it. We report only what we actually broke. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.