Account recovery abuse is the misuse of password-reset, email-verification, phone-verification, or identity-check flows to take control of an account. Instead of breaking the password directly, an attacker targets the “forgot password” path, social-engineers support staff, or uses leaked personal data to satisfy recovery questions and one-time checks.
This matters because recovery systems are often weaker than the main login. They may rely on knowledge-based answers, weak SMS verification, or support processes that are easier to manipulate than a password or passkey. In real attacks, exposed email addresses, phone numbers, and partial identity data can help an attacker impersonate the victim and reset access. Defenders reduce this risk with strong help-desk verification, MFA-resistant recovery methods, rate limiting, alerts for recovery changes, and low-trust handling of reset requests. A secure account can still be lost if its recovery path is not equally protected.