The weakest link in your security isn't your password. It's recovery.

What account recovery is

Every account you own has a recovery method: a backup email, a phone number, a set of security questions. It exists for one reason: to let you back in when you've forgotten your password. It is, by design, a way to bypass the password entirely.

Why it's the weak point

• It's built to bypass your password, that's the whole point of it.
• It often bypasses your 2FA too, through SIM-swaps, recovery codes, or security questions.
• A reset email you didn't request is the number-one documented sign of a compromised account.
• There is no mandatory human checkpoint on it, unlike money transfers, which the industry is now adding cooling-off periods to.

How account recovery bypasses 2FA

Two-factor authentication is designed to stop someone who has your password. It works. A stolen password alone won't get them in if there's a second factor. But recovery bypasses this entirely:

1. The attacker visits "forgot password", they don't need your password at all
2. The service sends a reset link to your recovery email, not your main inbox
3. Your 2FA app is never consulted. It protects the login door, not the recovery door
4. With the reset link, they set a new password, disable 2FA, and you're locked out

This is why security professionals describe account recovery as "the bypass that 2FA forgot." It's not a bug. It's a design choice that prioritises customer service over security. But the attacker knows to use it.

Alternative lockout attacks

An alternative lockout attack is the strategic version: instead of attacking the front door (password + 2FA), the attacker deliberately chooses the recovery channel because it's less guarded. They're not trying to log in, they're trying to trigger the lockout mechanism and take the alternative path in.

This is especially common when the attacker already knows you: an ex-partner, a family member with access to your devices, or someone who knows the answers to your security questions. They don't need to guess or phish anything. They walk to "forgot password" and request a reset to the recovery inbox they can already access.

How attackers use it

They don't break the lock; they walk around it. A SIM-swap reroutes your codes. A phishing page captures the reset link. Security questions get answered with details from your own social media, or, when the attacker is someone who knows you, from memory. In every case, the reset email is the payload, and your recovery inbox is the drop point.

Why the providers don't fix it

Account recovery is built for speed and for getting you back in, not for stopping the wrong person getting in. Friction there means support tickets and locked-out customers, so the gap stays open by design. It's structural, and it isn't closing on its own.

What the gap costs once it opens

Here's why this matters in dollars, not just theory. Once an attacker is in through recovery, the clean-up is rarely cheap. Across the industry, recovering from a ransomware or account-takeover incident commonly runs into the tens of thousands of dollars once you add up the downtime, the rebuild, and the specialist time to put things right. And paying doesn't buy certainty: even when a victim obtains a decryptor, files are frequently still missing or corrupted afterwards, so the ransom rarely restores everything it promised. That shortfall, the distance between "we paid" and "we got it all back", is exactly the gap this page names. It's cheaper to guard the recovery door than to pay for what comes through it. We would rather help you shut it now than help you count the cost later.

For a step-by-step look at how these takeovers actually play out, from silent access to hidden inbox rules, read how an account takeover really unfolds.

What closing the gap looks like

One checkpoint: intercept recovery mail before it reaches anyone, and require a human yes before it's released. That's the whole idea behind SAFE2RECOVER, and it's free. See how it works →

Official help and reporting

These are the official Australian services. They are free and they are the ones to trust:

• Scamwatch: report a scam, the national form for reporting a scam.
• Scamwatch: scam statistics, the published figures on scams reported in Australia.
• ReportCyber, the official place to report a cybercrime.
• IDCARE, free support for people whose identity or accounts have been misused.
• Australian Cyber Security Centre: so you think you have been hacked, a step by step for the hours after a compromise.