You picked a long password, turned on two-factor, and felt secure. Meanwhile the actual attack path runs around all of it — through your recovery email, your phone number, your security questions, and a support agent who believes a convincing story. This is how accounts really get taken, and how to close the door.
Security Researcher • Penetration Tester
Tarun Jaswani writes about technology and security for everyday people — the practical habits that keep ordinary lives safe online, explained without jargon and always from the side of the person trying to protect themselves.
Almost nobody's account gets taken by someone guessing their password. That is the movie version. The real version is quieter and far more effective: the attacker never touches your password at all. They go to the "forgot password" flow and work on the thing that sits behind it — your recovery email, your phone number, your security questions, or a support agent who can be talked into a reset. Every one of those is a door into the same house, and most people have spent years hardening the front door while leaving the others unlocked.
https://about.me/tarun_jaswani
This matters because your account security is not the strength of your password. It is the strength of the weakest path that leads to a password reset. If your bank login is protected by a twenty-character passphrase but the reset link goes to an old email address you have not opened since 2019, your bank login is protected by that old email address.
https://medium.com/@rajkarar814/how-cybersecurity-can-change-the-world-dd4cd368c346
The Recovery Chain — Draw It Before an Attacker Does.
Every important account has a chain behind it. Your bank sends resets to your primary email. Your primary email sends resets to a recovery email and a phone number. That recovery email may itself have a recovery option pointing somewhere else. Follow that chain far enough and you almost always arrive at one or two accounts that everything else depends on.
Those one or two accounts are your real crown jewels, and most people have never identified them. Take twenty minutes and actually map it: for each important account, write down where a password reset would be sent. Then do the same for those destinations. The account that appears most often at the end of the chains is the one that deserves the strongest protection you are capable of applying.
The single sentence version
Your account is only as secure as the weakest account that can reset it. Harden the recovery chain, not just the login.
Attack Path One: The Abandoned Recovery Email.
Old email addresses are a common weak point. A provider may reclaim a long-dormant address, an old work or college address gets deprovisioned, or the account simply sits unused with a password from a decade ago that has since appeared in a breach dump. If any of those addresses is still listed as a recovery option on a current account, it is a live path in.
Go through the recovery settings of your important accounts and remove every address you no longer actively control and monitor. Replace them with one you check regularly and have secured properly. An unmonitored recovery address is worse than none, because it lets a reset happen without you ever seeing the notification.
https://www.linkedin.com/in/tarun-jaswani-a85b55401/
Attack Path Two: Your Phone Number.
SMS-based recovery is convenient and structurally weak. A SIM swap — where an attacker persuades or bribes a mobile operator into porting your number onto their SIM — hands them every code sent to that number. It is not exotic; it is a known and repeatedly documented technique, and it is particularly damaging because the phone number often sits behind email, banking, and payment apps simultaneously.
• Move away from SMS codes wherever the service offers an authenticator app or a hardware security key. App-based codes are generated on your device and are not intercepted by taking over your number.
• Ask your mobile operator what protections they offer against unauthorised porting — many support a port-out PIN, a lock, or an in-person verification requirement. Enable whatever exists.
• Remove your phone number as a recovery option on accounts where you have a stronger method available. Keeping it "just in case" preserves the weak path you were trying to eliminate.
• Treat sudden loss of mobile signal as a possible signal, not just an outage. If your phone loses service unexpectedly and stays down, check with your operator rather than waiting it out.
https://x.com/TJaswani7857
Attack Path Three: Security Questions Are Public Records.
Mother's maiden name. First school. City you were born in. Name of your first pet. These were designed in an era before people posted their lives publicly. Today, most security question answers are discoverable from social media, public records, or a friendly conversation.
The fix is simple and slightly counterintuitive: do not answer security questions truthfully. Treat each one as a second password. Generate a random string, store it in your password manager alongside the login, and use that as the answer. There is no rule requiring your first school to be a real school. An attacker who researches your life perfectly still cannot guess a random string.
Attack Path Four: The Support Agent.
The hardest path to defend is the human one. An attacker calls or messages support, presents a plausible story and a handful of personal details gathered from breaches and social media, and asks for help getting back into "their" account. Support exists to help people who are genuinely locked out, which is exactly the sympathy an attacker exploits.
You cannot control the provider's training, but you can reduce your exposure. Enable any advanced protection programme the provider offers — several major platforms have one, and they typically restrict what support can do without a hardware key. Reduce the personal details that are publicly discoverable about you. And where a provider allows you to set a support PIN or passphrase required for account changes, set it.
https://github.com/tarunjaswani
What to Actually Do This Week.
- Map the recovery chain for your primary email, your bank, and your main payment app. Identify the one account everything ultimately depends on.
- Secure that account with the strongest method available: a hardware security key if supported, an authenticator app if not, plus a unique password stored in a password manager.
- Remove every stale recovery email and every unnecessary recovery phone number from your important accounts.
- Replace SMS codes with app-based or hardware-based codes anywhere the option exists.
- Overwrite all security question answers with random strings saved in your password manager.
- Turn on login and recovery alerts so an attempted reset generates a notification you will actually see.
- Enrol in the provider's advanced protection programme if one exists for your most critical account. https://github.com/tarunjaswani/agent-scripts A strong password protects the front door. Account recovery is the side gate, the back door, and the spare key under the mat, and it is where accounts are actually lost. Map the chain, find the account everything depends on, and protect that one as if everything depends on it — because it does. — Tarun Jaswani https://www.facebook.com/people/TarunJaswani/61588987721538/
TAGS
Top comments (0)