Topic starter
25/08/2026 6:10 pm
TL;DR: Password reset workflows remain a common account takeover path because legacy self-service systems rely on pre-registered factors and help-desk trust, while deepfakes and voice cloning make impersonation easier, according to Trusona. The real control shift is from authenticating a device to verifying the person at recovery time, because registered factors no longer prove identity.
Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “Identity Verification, Not Just Authentication: Rethinking Self-Service Password Resets”.
By the numbers:
- In 70% of SaaS breaches analysed by Obsidian Security, attackers were able to subvert MFA.
Key questions
Q: What breaks when self-service password reset still trusts pre-registered factors?
A: The reset flow becomes a takeover path because prior enrollment only proves that a factor was once attached to the account, not that the current requester is legitimate.
Q: Why do voice cloning and deepfake calls increase account recovery risk?
A: They raise risk because they supply the exact cues help desk staff use to decide whether a requester sounds legitimate.
Q: When should organisations use stronger identity proofing for account recovery?
A: Use stronger proofing when the recovery event carries higher risk than ordinary sign-in, such as account lockout, access restoration after repeated failures, or help desk calls involving sensitive systems.
Practitioner guidance
- Reclassify password reset as a high-risk identity journey Map every reset path that can modify MFA, add a device or release a reset link and apply stronger governance than standard self-service.
- Remove trust in pre-registered factors for sensitive recovery Stop treating SMS, email OTPs and authenticator enrolment as sufficient proof when the request can change access state.
- Introduce live identity proofing for recovery requests Require government ID validation, document integrity checks and authoritative data matching before any reset is approved.
Bottom line: Password reset is no longer a low-risk support function when attackers can impersonate users convincingly enough to influence recovery decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Recovery trust is now an identity security control, not a service convenience. Password reset is one of the few places where an organisation deliberately suspends normal authentication discipline and accepts a recovery claim instead. That makes it a prime identity governance boundary, especially when the claimant can be impersonated through deepfakes, stolen personal data or help-desk manipulation. The practical implication is that recovery must be governed with the same rigour as initial authentication.
A few things that frame the scale:
- According to Forrester Research, a single password reset can cost around $70.
A question worth separating out:
Q: What should security teams do after a password recovery flow is abused?
A: They should revoke the newly issued factors, review every recovery action tied to the affected identity and inspect support records for similar approval patterns. The incident usually indicates that the reset workflow, not just the endpoint account, needs containment and redesign.
👉 Read our full editorial: Identity verification is replacing weak password reset trust