Account recovery fraud: how attackers take over accounts through the reset flow

You can lock the front door of a login with a strong password, MFA, and a passkey, and an attacker will simply try the back one. Account recovery, the "forgot password" and reset flow, is where takeover attempts go once the login itself is hardened, because recovery is designed to let a real user back in after they have lost their credentials, and that is exactly what an attacker wants to look like.

A quick clarification, because the phrase is overloaded. This guide is about account recovery fraud in the security sense: attackers abusing a platform's recovery flow to seize accounts. It is not about the consumer "recovery scam," where a fraudster charges a victim an upfront fee to "recover" a lost account or money. Here the target is the reset flow itself. This guide covers how that attack works, why recovery is so often the weak point, and how to defend it.

Key takeaways

• Account recovery fraud is the abuse of a platform's password-reset or account-recovery flow to take over an account, bypassing the login defenses entirely.
• Recovery is the weak point because it deliberately lowers the bar: it falls back to email, SMS, security questions, or a support agent, any of which can be phished, SIM-swapped, guessed, or socially engineered.
• The strongest defenses harden recovery to match the login, and read the context of the recovery attempt, especially whether it comes from a device the account has ever used.
• A recovery request from an unfamiliar device on an anonymized connection is one of the clearest takeover signals there is.

What is account recovery fraud?

Account recovery fraud is when an attacker uses a platform's own account-recovery process, the password reset, the "lost access" flow, the support-driven restore, to gain control of an account they do not own. Rather than crack the password or defeat MFA, they convince the recovery process that they are the locked-out owner and let the platform hand them the keys.

This matters because recovery sits outside the defenses everyone focuses on. A team can require a strong password, enforce MFA, and roll out passkeys, and still be wide open if the reset flow only asks for a code sent to an email the attacker already controls. The recovery path is a second, quieter front door, and it is often built to be easy on purpose, because a recovery flow that is too hard locks out real users. That tension, easy enough for the owner, hard enough for the attacker, is the whole problem. The scale behind it is real: the 2026 Javelin Identity Fraud Study put traditional identity-fraud losses at $27.3 billion in 2025, affecting 18 million victims.

Account takeover, the outcome a hijacked recovery flow ultimately delivers, was the costliest of those categories. The same Javelin research counted 6 million US account-takeover victims in 2025, up from 5.1 million in 2024, with losses above $15 billion.

How account recovery fraud works

Attackers reach the recovery flow through whichever fallback factor is weakest:

• Email or SMS interception. If recovery sends a reset link or code to an email or phone the attacker has already compromised, they simply receive it. This is the most common path.
• SIM swapping. By hijacking the victim's phone number, an attacker receives SMS reset codes directly. Regulators have taken notice: the FCC adopted SIM-swap protection rules in 2023 precisely because it is such a reliable recovery-bypass.
• Security-question guessing. Answers to "your first pet" or "the street you grew up on" are often findable in breaches or on social media, so knowledge-based recovery is weak by design.
• Support social engineering. An attacker contacts customer support posing as the locked-out user, supplies a few real details, and pressures an agent into resetting access manually.
• Recovery-email seeding. In some attacks, the fraudster quietly adds their own address as a recovery contact earlier, then triggers recovery to it later.

In each case the login's own strength is irrelevant. The attacker never touches it; they walk in through the process meant to help a real user who cannot.

Why the recovery flow is the weak point

The recovery flow is weak for a structural reason, not a careless one. Its job is to restore access to someone who has, by definition, lost their normal way of proving who they are. So it has to fall back to something else, and that something is almost always weaker than the login it replaces: a code to a recoverable inbox, a text to a swappable number, a question with a findable answer, or a human agent who can be talked around.

That is why hardening the login alone does not close the gap. Passwordless methods and MFA raise the cost of attacking the front door, which pushes attackers toward recovery, and the NIST digital identity guidelines treat account recovery and re-binding as a distinct, security-critical step for exactly this reason. If recovery is easier than login, then recovery, not login, is your real security level. Closing the gap means making recovery prove identity as hard as login does, and reading the context of the attempt to catch the ones that look wrong.

How to prevent account recovery fraud

Defending recovery is about raising its assurance to match the login and watching how each attempt behaves:

• Use strong recovery factors. Prefer a pre-registered passkey or authenticator over an SMS code or a security question. Move knowledge-based recovery out of the critical path.
• Step up on the recovery itself. Treat a reset or a recovery-contact change as a high-risk action that can require its own verification, not a quiet side door that trusts a single code.
• Read the device behind the request. A recovery attempt from a device the account has used for years is very different from one from a device it has never seen. Recognizing the device turns "someone is resetting this account" into "someone on an unfamiliar machine is resetting this account."
• Watch velocity and anonymity. Bursts of reset attempts, or a recovery arriving over a VPN, proxy, or anti-detect browser, are strong signals that the request is not the real owner.
• Notify and delay. Alert the account's known contacts on a recovery attempt and add a short hold for high-risk changes, so a real owner can stop a takeover in progress.

The first two raise the bar for everyone; the last three reserve the friction for the attempts that actually look like an attack.

The device earns that weight for a concrete reason we measured. We ran recovery attempts from a machine the account had never touched and pushed them through a VPN, and the request matched a legitimate reset in every field the flow inspects; the one thing out of place was that neither the device nor the connection fit the account's own history. A reset from a familiar device is quiet, while the same reset from an unknown one on a masked connection is the clearest takeover tell the flow gets.

Recognizing the device behind a recovery request with ShieldLabs

ShieldLabs adds the device signal that tells a recovery attempt by the real owner apart from a takeover, working alongside the recovery flow and identity verification you already run. You add one JavaScript snippet to your reset and recovery pages, and each attempt returns persistent identification that recognizes a returning device across cleared cookies and a rotated IP, so a recovery from a device the account has used before looks very different from one from a device it has never seen.

Alongside it, each visit returns a risk score from 0 to 100 and the named anonymity signals, VPN, proxy, Tor, and anti-detect browser use, that so often accompany a takeover attempt. That lets your recovery flow stay smooth for a real owner on a familiar device and reserve a step-up, or a hold, for a reset arriving from an unfamiliar device on a masked connection. ShieldLabs scores the attempt and names the evidence through the API and webhooks; your own recovery logic decides what to require next, so the decision stays in your stack. It pairs naturally with the device-based authentication that protects login, closing the recovery gap that account takeover exploits, and the free tier covers your first 5,000 identifications.

Sources

1. FCC: FCC Adopts Rules to Protect Consumers from SIM Swap and Port-Out Fraud (2023)
2. NIST: SP 800-63B Digital Identity Guidelines, Authentication and Lifecycle Management
3. Wikipedia: SIM swap scam
4. Javelin Strategy & Research: 2026 Identity Fraud Study: The Illusion of Progress (2026)