Strengthen password reset security by requiring additional account ownership verification
Strengthen password reset security by requiring additional account ownership verification
I would like to suggest improving the security of the password reset and account recovery process.
Currently, if a user can verify ownership through only one recovery channel, such as SMS verification or email verification, they may be able to reset the account password. However, relying on a single recovery factor creates security risks, because SMS and email accounts can sometimes be compromised through SIM swapping, phishing, account takeover, or unauthorized access.
I suggest adding an additional ownership verification step before allowing a password change through email or SMS recovery.
For example, after completing email or SMS verification, require one additional verification factor, such as:
- Previous password (when available)
- Authenticator app verification
- Passkey or security key verification
- Confirmation from a trusted device
- Recent account activity verification
A possible security flow could be:
Recovery request
→ Email verification OR SMS verification
→ Additional ownership verification
→ Allow password change
For accounts with MFA enabled, sensitive actions such as password changes, disabling MFA, or changing recovery methods should require stronger authentication, such as:
Email/SMS verification
+
Authenticator / Passkey / Security Key
→
Password change allowed
The goal is not to make account recovery impossible, but to ensure that a person who controls only one recovery channel cannot easily take over an account.
A verified phone number may still be useful for product eligibility or account verification purposes, but it should not automatically become a sufficient factor for high-risk actions such as changing passwords.
Thank you for considering this security improvement.