The Outlier Lab

Account Recovery Abuse

Abusing password reset, contact change and support-assisted recovery to take over accounts holding value, often the weakest path once login itself is hardened.

What it is

Recovery flows are designed for people who have lost their factors, which makes them a back door around those factors. An account's real security is set by its weakest way in, and after you deploy passkeys or strong MFA, that is usually recovery. NIST SP 800-63B-4 builds this into the standard. When a subscriber can't authenticate at the required assurance level, recovery has to follow defined procedures rather than drop to something weaker.

Each recovery path has its own typical weakness and its own exit.

SurfaceTypical weaknessExit it enables
Self-service password resetRelies on email or SMS that may already be compromisedFull ATO
"Lost device or factor" flowFalls back to knowledge questions or document uploadFactor re-enrollment to attacker
Contact change (email, phone)Allowed within a session, or with weak proofControl of all future recovery
Support-assisted recoveryAgent judgment under time pressure; knowledge-based questionsAnything the agent can do
Identity re-verification (ID plus selfie)Synthetic documents; AI-generated mediaRecovery to a new device
Account-holder death or estate processesRare, low familiarity among staffFull asset transfer

How it works

Diagram: Gather victim data (leaks, OSINT, prior phishing), Choose weakest recovery path, Self-service reset via compromised email or phone, Support call or chat with pretext, New password, contacts and devices, Payout change, liquidation, ACATS, redemption

Conceptually, attackers start from what they already have (leaked personal data, a compromised email inbox, a hijacked number) and choose the recovery path that asks only for that. Support channels are attractive because a human can be persuaded and can override automated checks. When an insider is involved, the pretext can be skipped entirely (see Insider Fraud and Insider Access Controls).

Transaction footprint

Recovery is a state change that should reset trust. The losses come when the platform treats a freshly recovered account as if it had its old trust.

StageWhat you see in the dataDecision point
Pre-recoveryFailed logins; recovery attempts across channels; support contacts asking "what email is on file?"Cross-channel attempt linking
RecoveryReset or re-verification from a new device; agent-initiated contact changeRecovery risk scoring; support verification standard
Post-recoveryNew devices and factors enrolled; old email or phone removed; notification settings changedNotify old contacts; Contact Change Cooling-Off Periods
StagingNew payout destination, bank link or receiving brokerHold new destinations for a defined window
Cash-outWithdrawal, ACATS, P2P, reward redemptionWithdrawal and Payout Controls with recovery recency as a feature

Common variants

VariantWhat's differentWhere it shows up
Email-first takeoverAttacker owns the recovery inbox, so reset is trivialAll
SMS reset after SIM swapPhone number hijacked firstBanks, crypto, brokerages
Help-desk pretextingPersuasive story; urgency; partial personal dataAll, especially chat and phone support
Insider-assisted recoveryAgent paid to change contacts or disable MFAOutsourced support operations
Synthetic re-verificationFake ID or AI-generated selfie in a "verify it's you" stepFintechs with ID-based recovery
Recovery-code theftStored recovery codes stolen from the device or cloudAccounts with backup codes
Known-person recoveryFamily member who knows the answersElder and family exploitation

Where it shows up

  • Brokerage. Recovery, then bank change, then liquidation and withdrawal, or ACATS out. FINRA's ATO notice describes firms treating email-based codes cautiously and using less publicly available questions for resets. See Brokerage and Investing and ACATS Transfer Fraud.
  • Neobanks and P2P. "New phone" flows are a common ATO entry, followed by transfers out. See Neobanks and Consumer Fintech.
  • Rewards and marketplaces. Agent-assisted email changes followed by redemption or payout redirection. See Payout Redirection and Loyalty and Rewards Redemption Fraud.
  • Crypto. Recovery and re-verification are high-value targets because the exit is irreversible.

Impact

  • Direct loss. Recovery abuse tends to produce full takeovers (owner locked out), so the attacker has time to drain everything.
  • Support cost. Hardening recovery raises legitimate lockout volume and handle time. Plan staffing with Support Team Fraud Training and Alert Review Operations.
  • Insider exposure. Support-side compromise can expose many customers at once, through direct account changes or by leaking the data that powers impersonation and recovery pretexts. See Insider Fraud and Insider Access Controls.
    • Public example. In a May 2025 Form 8-K, Coinbase disclosed that a threat actor had paid several support contractors or employees outside the US to pull customer data from internal systems, then demanded money not to release it. The data included names, contact details, masked SSN and bank data, ID images, balances and transaction history. No passwords, private keys or direct access to funds were involved. Some customers were then socially engineered into sending funds to the attacker. Coinbase estimated $180M to $400M in remediation and voluntary reimbursement costs.
    • For recovery design, support-tool data is exactly what makes an impersonation or recovery pretext convincing, so treat "the caller knows my details" as worthless verification.

Red flags

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventSecure Account Recovery DesignRecovery is at least as strong as login; tiered by account value
PreventPasskeys and Phishing-Resistant Authentication with multiple registered credentialsFewer customers ever need recovery
PreventCustomer Support Verification ProtocolsAgents verify out-of-band; no contact changes on knowledge answers alone
PreventInsider Access ControlsDual control and audit on agent-initiated changes
DetectRecovery risk scoring with cross-channel linkageSpots coordinated attempts
RespondContact Change Cooling-Off Periods, Withdrawal and Payout ControlsValue stays put while the real owner is notified
RespondDocument Verification and LivenessRe-verification resistant to synthetic media, for high-value recovery

Emerging variants and adversary adaptation

  • Passkey adoption shifts attacks to recovery. In FIDO's 2026 survey, organizations named device recovery and account restoration as a barrier to passkey deployment. Consumer platforms face the same tension, because each recovery convenience is another fallback an attacker can use.
  • Synthetic media in re-verification. FinCEN's November 2024 deepfake alert (FIN-2024-Alert004) flags warning signs during live verification, including third-party webcam plugins and switching communication methods after repeated "glitches." Those same signs apply to recovery re-verification. See Generative AI and Deepfake Fraud.
  • Help-desk social engineering at scale. Organized groups have shown they can pressure support staff into resetting factors. Consumer fintech support, often outsourced and measured on handle time, is the consumer version of that risk.
  • Voice cloning. Voice is no longer a reliable identity signal in phone recovery. Move high-risk recovery to app-based flows on existing devices, or to strong re-verification.
  • What's next. Expect attacks on trusted-contact and social recovery features as platforms adopt them. Design them with the same cool-offs and notifications.

Real-world examples

  • Case Study - FTX Theft via SIM Swap (2022): number takeover enabling access to protected accounts.
  • FINRA Regulatory Notice 21-18 documents broker-dealer practices for secure resets and caution about email-based codes.

Sources and further reading