What it means
Account recovery replaces the normal proof of access when someone loses a phone, security key, or other authenticator. That makes it a second entrance to the account. A strong sign-in method can be undermined if a caller can persuade support to enroll a replacement using easily discovered personal details. Plan recovery at enrollment, including a backup method, a way to report fraudulent resets, and extra scrutiny for powerful accounts. Recovery should restore the right person’s access without silently preserving an attacker’s access.
AN ILLUSTRATIVE SCENARIO
A lost phone before a hospital shift
A nurse arrives without the phone used for sign-in. The help desk follows a documented recovery route using previously established evidence, rather than accepting a photograph sent to a new email address. A supervisor can help locate the right support team, but knowing the supervisor’s name is not proof of identity. The desk records the decision, binds a replacement authenticator, and sends an independent notification through an existing contact channel.
Put it to work
- List supported recovery methods and their requirements before users lose access. Give people instructions for protecting backup codes and keeping recovery contacts current.
- Use a documented verification workflow with a defined escalation route. Separate privileged-account recovery from ordinary requests, and avoid collecting unnecessary identity documents.
- Invalidate replaced authenticators and used recovery codes as appropriate. Review active sessions and separately revoke suspicious access; replacing a sign-in factor may leave sessions alive.
How to check your work
Exercise recovery with a test account. Confirm that a legitimate user can finish, a caller with only public information cannot, notifications arrive independently, and old factors or selected sessions no longer work.
Connect the ideas
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
- MFA
Authentication that requires more than one factor, such as something you know plus something you have.
- Session
State linking multiple requests; an authenticated session associates later requests with a previously authenticated identity until it expires or is revoked.
- IAM
The capability for creating identities, authenticating them, authorizing actions, and managing their lifecycle.