Email and phone possession are no longer strong proof of identity because attackers can buy breached data, intercept codes through SIM swaps, or impersonate victims with deepfake-assisted pretexts. Those signals may show channel access, but they do not reliably prove the person requesting access is legitimate.
Why This Matters for Security Teams
Email and phone checks are often treated as proof of possession, but in an ATO attack they usually prove only that an attacker can reach a channel, not that they are the rightful account holder. That distinction matters because modern takeover attempts combine breached credential sets, SIM swap fraud, mailbox compromise, and social engineering into a single workflow. Current guidance suggests that identity proofing must be separated from recovery and MFA enrollment, especially when the same channels can be controlled by the attacker.
NHI Management Group’s Ultimate Guide to NHIs shows how often weak identity assumptions turn into operational exposure, and the same pattern appears in human account recovery when email or SMS is treated as an authoritative trust signal. Security teams should compare these assumptions with the control expectations in CISA cyber threat advisories, which consistently show that access paths, not just passwords, are targeted.
In practice, many security teams encounter email and phone-based takeover only after recovery flows or help desk approvals have already handed control to the attacker.
How It Works in Practice
ATO campaigns rarely depend on a single bypass. Attackers often start with leaked credentials, then use email access to intercept reset links or SMS to capture one-time codes, or they impersonate the victim in a support interaction. A phone number can also be ported, cloned, or forwarded, which means the channel is present but the person is not. This is why possession-based checks are weak when used alone.
Better practice is to treat email and phone as supporting signals, not decisive evidence. Stronger identity assurance usually combines several elements:
- Step-up verification using a separate, higher-assurance factor for sensitive recovery events.
- Risk-based controls that look at device, session, location, velocity, and prior account behavior.
- Recovery workflows that require out-of-band checks or verified in-person processes for high-value accounts.
- Help desk procedures that prevent reset approval based only on caller knowledge or channel control.
For broader control design, the NIST control family in NIST SP 800-53 Rev 5 Security and Privacy Controls supports stronger authentication, identity proofing, and access enforcement than basic channel possession. NHIMG’s 52 NHI Breaches Analysis also reinforces a core lesson: once an attacker can impersonate a trusted identity path, recovery becomes the easiest path to compromise. These controls tend to break down in customer support-heavy environments because agents are pressured to resolve requests quickly and override evidence-based checks.
Common Variations and Edge Cases
Tighter recovery controls often increase friction, requiring organisations to balance account security against user support burden and false rejects. That tradeoff becomes especially visible for executives, contractors, and remote workers who may lose access to both primary email and mobile devices at the same time.
There is no universal standard for this yet, but current guidance suggests separating low-risk convenience recovery from high-risk account recovery. For example, a password reset for a low-value consumer account may tolerate email verification plus device history, while a privileged admin or finance account should use stronger proofing and require a secondary trusted path. Deepfake-assisted pretexts and real-time call spoofing also weaken voice or phone callbacks, so teams should not rely on conversation quality as evidence of legitimacy.
Another edge case is MFA reset. If the same compromised email or phone number can re-enroll the attacker’s own factor, the original MFA protection becomes irrelevant. Practitioners should compare these weaknesses with emerging adversary patterns described in Anthropic’s report on the first AI-orchestrated cyber espionage campaign, where automation increases the scale and speed of social engineering. NHI Management Group’s Key Challenges and Risks discussion is useful here because it shows how trust assumptions fail when an identity channel is easier to compromise than the account itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-01 | ATO defense depends on stronger identity proofing than email or phone possession. |
| NIST SP 800-63 | IAL2 | Email and phone checks are weak proofing signals for account recovery. |
| OWASP Non-Human Identity Top 10 | NHI-05 | Weak recovery and secret handling patterns mirror identity takeover risk. |
| NIST AI RMF | Risk-based authentication needs governance for dynamic identity decisions. | |
| NIST Zero Trust (SP 800-207) | RA-3 | ATO prevention benefits from continuous context evaluation, not static trust. |
Re-evaluate trust at each sensitive action instead of relying on initial channel access.
