Account recovery fraud

Account recovery fraud is the abuse of forgot-password and account-reset flows to mint fresh credentials for an attacker. Recovery is authentication with the strong factors removed, by design it works when normal credentials fail, so it authenticates on weaker evidence like knowledge questions and SMS codes, which is precisely where SIM-swap-equipped attackers aim.

The asymmetry is structural. Recovery exists to work when the strong factors are unavailable, so it cannot require them, and whatever it does require becomes the account's real security floor. An account protected by a passkey and recoverable by an SMS code is an SMS-protected account with extra steps.

The useful fix is to make recovery prove something the attacker cannot hold, such as the state of the line itself, rather than something sent to the line.

Because recovery is the designed bypass, it is also the path an attacker reaches for first, and its volume gives them cover. Legitimate users forget credentials constantly, so recovery traffic is high, noisy and under pressure to convert, which is exactly the combination that makes tightening it politically hard inside a product organization.

The evidence recovery can ask for splits into two kinds, and the distinction decides whether it works. Something sent to a channel, a code by message or mail, can be received by whoever currently controls that channel; something about a channel, such as whether the line behind the number changed in the last day, cannot be produced by an attacker who has merely taken the channel over. The second kind is what SIM swap detection supplies.

Knowledge questions belong in the first category despite feeling like the second, since the answers are frequently discoverable and increasingly present in breach corpora. Treating them as identity evidence rather than as a weak tiebreak is how a floor gets set well below the passkey the account advertises.