Anatomy of a Fraud Attempt: The Password Reset That Was the Attack
There is a version of account takeover with no breach, no malware, and no stolen password.
The attacker uses the recovery flow exactly as it was designed to be used.
One of the world's largest digital platforms described the shift plainly: "It used to be that attackers tried to steal user passwords through data breaches or malware. Now, they don't bother. Instead, they pose as users and simply reset passwords to gain entry. This new exploit targets the recovery process itself."
Key takeaways
- Recovery is a login path with weaker requirements, and it usually belongs to a support organization outside the security perimeter.
- The attacker supplies correct answers, because the answers are the account holder's real data.
- Resetting credentials also resets MFA, so hardening the login does nothing.
- Rebuilding recovery around verified identity took one platform to zero fraudulent password resets.
How the scheme works
- Choose a target worth the effort. High-value or high-profile accounts, identified from public profiles or from data already circulating after previous breaches.
- Assemble the answers. Date of birth, address history, previous employers, family names. Knowledge-based questions ask for facts about a person, and facts about people are the most widely leaked category of data there is.
- Start a reset. The attacker enters the flow as the account holder, supplying correct information at every step.
- If automation blocks the path, escalate to a human. A phone call explaining that the phone number changed and the backup email is dead is indistinguishable from the thousands of real versions of that call. CISA and the FBI documented exactly this in July 2025, describing a group that "targets large companies and their contracted information technology (IT) help desks."
- Take the account and close the door. Change the password, replace the recovery email and phone, re-enrol MFA on a new device. The real owner is now locked out of their own account by the security controls meant to protect it.
Why it gets past normal checks
Every answer the attacker gives is correct. That is the whole problem.
Knowledge-based verification tests whether someone knows facts about a person, and it cannot distinguish the person from anyone who has bought their data. The account holder's real history is the attack material.
MFA does not save you either, because the reset replaces it. Strong passwords do not save you, because nobody is guessing a password. The platform that rebuilt its flow found its security questions could be "easily guessed by fraudsters," and that putting a person behind the reset button created its own exposure, since "a human behind a 'reset' button could be tricked, bribed, or coerced."
Three independent sources flagged the same shift within twelve months. Mandiant's M-Trends 2026 found voice phishing surged to 11% of initial infection vectors, now the second most common, while email phishing dropped to just 6% of intrusions. Verizon's 2026 DBIR added pretexting as a newly tracked initial access vector at 6% of all breaches, naming attackers "impersonating help desk agents or users needing a password reset."
How Proof disrupts the fraud scheme
Proof changes what recovery asks for. Knowing things about a person stops being sufficient.
Ask who, and stop asking what.
The user presents a government-issued ID and a live selfie. Proof checks the document, matches the face against it, and returns a one-time recovery code to the platform. Data an attacker can buy does not open that door.
Take the human out of the decision, and keep them for the exception.
The verification runs without a support agent making a judgment call under pressure, which removes the layer that can be talked into a reset. Where a case genuinely needs review, it routes to a trained agent, never to a general support queue.
Leave a record.
Every session produces a pass or fail with a tamper-evident audit trail, so a disputed recovery is answerable afterward.
The platform's outcome: average recovery time about 12 minutes, and zero fraudulent password resets since launch. It also reopened a door that had been shut on legitimate users. More than 150 million people attempt a reset there each year, and roughly 10% had never regained access at all, which the company describes as "as many as fifteen million people are locked out of their accounts forever."
The question to ask
What is a support agent allowed to do on a phone call? If the answer includes resetting credentials or moving MFA based on information a determined stranger could assemble, hardening your login will not help you.
To learn more about the fraud patterns we see emerging in 2026, check out our field guide.
.jpg)
.jpg)
