IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Account recovery for customers
Maya forgot her password, or she lost the phone that holds her authenticator app. She needs a way back in, and attackers love that way. Your goal: build recovery that is as strong as login.
- Recovery lets someone in without the usual proof, so attackers aim at it.
- Recovery routes differ: backup codes are strong, security questions are weak.
- A reset link is a credential: single-use and short-lived.
- Never reveal which emails have accounts.
- Add step-up, a notice and a short delay.
The side door
You have likely done this at 11 p.m. You tap "Forgot password" and wait for the mail, feeling stuck. Maya wants in fast. A thief wants the same speed. Your job is to be quick for Maya and slow for the thief.
Account recovery is any process that gives access back when the normal credential is gone. It lets someone in without the usual proof. So an attacker who cannot beat your passkey login does not try. They use the recovery door instead. If that door is weaker, your login hardening does not help. Real takeovers use guessed security questions or SIM swaps on the recovery path.
Maya's new phone does not know her old passkey. She taps "Can't sign in?". The flow emails a single-use link to her verified inbox and tells her a recovery has started. The account holds payment details, so it also asks for a backup code. She is back in minutes later. An attacker who tried the same button had no inbox and no backup code.
Recovery routes are not equal
Every recovery method is a credential in disguise. Rank each one by how hard it is to steal from far away.
| Recovery route | Strength | Why |
|---|---|---|
| Backup passkey or offline recovery codes | Strongest | A backup passkey is phishing-resistant. Printed codes have no remote channel to hijack, but a caller can still talk someone out of them. |
| Email reset link | Medium | It is only as strong as Maya's email account. That inbox is the master key to everything. |
| SMS code | Weak | A SIM swap or interception beats it. |
| Security questions | Weakest | Answers like a mother's maiden name are in public records. They are not secrets. |
A reset link is a credential
A password-reset link is a short-lived credential, so it must behave like one.
- Single-use. It works once and is dead after that.
- Short life. Minutes, not days.
- Kill the rest. When a new password is set, every other reset link and every old session dies.
- Do not leak who has an account. Say "If that address is registered, we sent a link" every time, with the same response time. Then attackers cannot test addresses one by one. This leak is called account enumeration.
- Tell her. After a reset, email her that the password changed.
Make the side door as strong as the front
Recovery should feel a little heavier than login, on purpose. Use these layers.
- Step-up. Ask for one more proof, such as a backup code, before a valuable account changes hands.
- Notify. Tell the owner about every recovery attempt. The real Maya can answer "that was not me".
- Cooling-off period. Add a short delay on sensitive changes. It gives that alarm time to arrive.
- Two cases, two levels. An account lockout is a timed unlock for a customer who tried too many times. It needs little scrutiny. True credential recovery means the credential is gone, so you must replace it. It needs much more.
Most takeovers do not beat a password. They use a recovery flow that trusts something an attacker can get. Make recovery as strong as login, never weaker.
Go deeper: Email is the master key
For most people, the email inbox is the master key. If Maya's email account has no MFA, that inbox is the real front door, and you do not control it. Encourage customers to protect it (see MFA enrollment & factors). NIST calls SMS a "restricted" authenticator. After a reset, send the customer through the normal login. Do not sign her in automatically.
Go deeper: Passkeys and recovery
Many passkeys sync through the user's platform account, so a lost phone often does not mean a lost passkey. Device-bound keys, such as a hardware security key, do not sync. In both cases, plan more than one way in: a second passkey, saved recovery codes, or a careful identity check. NIST SP 800-63B-4 (section 4.2) covers saved recovery codes and codes issued to a contact on file. Do not fall back to SMS for an account that has a passkey, or you give attackers a downgrade path. OWASP's Forgot Password cheat sheet adds that security questions should never be the only reset method.
🧪 Interactive lab — enable JavaScript to play with this one.
A strong recovery route is a backup passkey. Grade your WebAuthn setup with Passkey Check. Then check that a finished recovery really ends old sessions, with Logout Check.