Topic starter
15/08/2026 6:11 pm
TL;DR: Password reset abuse is now a mainstream account takeover path, with nearly 1 in 4 reset attempts reported as fraudulent and businesses expected to lose $91 billion to ATO fraud by 2028, according to Fingerprint. The control gap is not password strength but recovery governance, because attackers can hijack email, SMS, support workflows, and MFA changes to replace the real user.
Editorial analysis by NHI Mgmt Group, based on content published by Fingerprint: “5 ways to prevent password reset attacks”.
Key questions
Q: What breaks when password resets are not centrally governed?
A: When reset workflows are fragmented, organisations lose consistent verification, auditability, and policy enforcement.
Q: Why does weak IAM create such high fraud and compliance risk in banks and credit unions?
A: Weak IAM creates risk because financial institutions handle sensitive personal and financial data, operate under strict regulation, and are attractive targets for fraudsters.
Q: What are the warning signs that password reset abuse is underway?
A: Watch for bursts of reset requests from one device, requests at unnatural intervals, resets that arrive immediately after account creation or failed login, and resets that bypass the normal user interface through API calls.
Practitioner guidance
- Separate recovery from factor changes Require a distinct verification step before any MFA factor can be added, removed, or replaced during a reset flow.
- Harden help desk recovery scripts Remove reliance on easily stolen data such as date of birth, address, and public social details when support agents approve a reset.
- Monitor reset request anomalies Flag high-volume requests, machine-perfect cadence, and direct API reset attempts as likely abuse patterns rather than user behaviour.
Bottom line: Password reset abuse succeeds because the recovery path is often weaker than the login path, and attackers can exploit that difference to replace the user entirely.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:19 pm
Recovery governance is now a primary identity security control, not a support detail. Password reset abuse shows that attackers do not need to defeat the password if they can control the recovery path. That shifts the governance question from authentication strength to assurance around channel ownership, support escalation, and factor change authority. For IAM and CIAM teams, the reset workflow is part of the identity perimeter, and it needs the same control discipline as sign-in.
A few things that frame the scale:
- Password-related issues can represent 10–50% of service desk calls, many of which are avoidable.
A question worth separating out:
Q: Should organisations treat password screening as part of MFA or as a separate control?
A: Treat it as a separate control that complements MFA. MFA verifies the second factor, while screening governs whether the first factor should be allowed to exist at all. Keeping those responsibilities distinct makes the authentication stack easier to assess and audit.
👉 Read our full editorial: Password reset attacks expose the real account takeover weak point