The short answer
Every authentication system has a second system behind it for people who lose their credentials. That recovery system must, by definition, let someone in without the thing that normally proves who they are.
It is therefore always the weaker path, and a competent attacker goes there first. Hardening your login while leaving recovery on defaults is like fitting a deadbolt and leaving the key under the mat — the door is genuinely stronger and it does not matter.
The useful question is not “how strong is my authentication” but “what is the cheapest way for someone to convince this provider they are me?”
Recovery is a chain, and it has a root
Draw the dependencies for any account and you find a tree. Your bank recovers through your email or your phone number. Your email recovers through a backup address, a phone number, or a recovery code. Your phone number recovers through your carrier account. Your carrier account recovers through personal details and possibly a photograph of an identity document.
Follow every branch to its end and you find the root — the account or credential with no dependency above it. The security of everything below is capped by the security of that root. A bank account protected by a hardware key, recovering through an email protected by a password from 2019, is protected by that password.
For most people the root is one of three things: their primary email account, their mobile phone number, or their identity documents. All three deserve treatment proportionate to that role, and almost nobody gives it to them.
Where the chain breaks
The knowledge-based questions. Mother’s maiden name, first school, first pet. These were designed when the answers were genuinely private. They are now routinely available from public records, social media, and breach data. Worse, they are static — once exposed, permanently exposed — and shared across every provider that asks the same question.
The fix is to treat them as passwords: generate random strings, store them in a
password manager, and never answer them truthfully. “First school:
k7Qz-vault-mint” is a valid answer, and it is the only version of this control
that works.
The help desk. A human under time pressure, measured on call handling time, trained to be helpful, facing someone who sounds distressed and has three pieces of correct personal information. This is the highest-yield route into most organisations and it does not require any technical capability at all.
Attackers prepare properly: background noise suggesting a busy street or a crying child, a plausible reason for the missing factor, and enough real detail to seem verified. Many organisations have hardened this since it became a well-publicised route into large companies, but coverage is uneven and the pressure that creates the weakness is structural.
Document-based verification. Uploading a passport photo is increasingly the recovery route of last resort. Identity documents leak in breaches constantly, they cannot be rotated, and a scan is not a document. Liveness checks help. They are not universally deployed and they are not unbeatable.
The forgotten backup method. An old phone number you no longer control, or a secondary email address you abandoned, still sitting in a recovery configuration. Recycled phone numbers are reassigned to new customers, and an abandoned email address at a provider that reclaims dormant accounts is a live vulnerability. This is the one people find when they audit and it is very common.
Recovery codes stored badly. The one-time codes you were given at enrolment, screenshotted to a photo library that syncs to a cloud account, which recovers through the email you are trying to protect. The circularity defeats the point.
Hardening the root
Start at the root and work down. Fixing a leaf while the root is weak achieves nothing.
Your primary email. Put a passkey or hardware security key on it. Remove SMS as a recovery method if the provider allows it — on major providers, adding a strong factor unlocks that option. Generate recovery codes and store them somewhere genuinely offline. Then check the account’s recovery settings for old addresses and numbers, and remove them.
Consider a dedicated email address used only for financial accounts, never published, never used for anything else. It is not security through obscurity so much as reducing the number of places the address appears in breach corpora.
Your phone number. Set a port-out PIN with your carrier. Ask specifically — the option is rarely offered. If your carrier supports an account-level verification passphrase, set that too. This is the control that protects everything using SMS anywhere in its recovery chain, which is more than you think.
Your password manager. Increasingly the root for many people. Long unique master password, strongest available second factor, and emergency access configured deliberately rather than left at defaults. Understand what happens if you lose the master password: for most reputable managers, the honest answer is that the data is unrecoverable, which is the correct design and means your recovery codes must live outside it.
An audit worth doing once
Take an hour. For each account holding money or acting as a root:
- List every recovery method configured. Email addresses, phone numbers, backup codes, security questions, trusted contacts.
- Remove everything you no longer control. Old numbers and abandoned addresses are the most common finding.
- Replace truthful security-question answers with random strings, stored in your password manager.
- Ask what the provider’s manual recovery process is — what happens if you lose everything. The answer tells you what an attacker would have to fabricate. Providers that will not say are telling you something too.
- Store recovery codes offline. Printed and physically secured, or on hardware that is not the device you are protecting. Not in the photo library.
- Write down the chain. Literally draw it. The dependency you did not know about is the one that gets used.
The trade-off nobody escapes
Hardening recovery increases the chance you lock yourself out permanently. This is not a hypothetical risk and it is not rare — people lose access to accounts they own far more often than they are attacked.
The resolution is redundancy rather than austerity: two hardware keys rather than one, with the second stored somewhere physically separate. Recovery codes printed and kept where a fire would not take both. A trusted person who can reach the backup if you cannot.
Pick the level of hardening you can sustain, then make it survivable. A control so strict that you disable it after the first lockout scare has protected nothing. The point is not maximum security; it is a chain whose weakest link you have actually looked at.
Related: account takeover: how it actually happens covers the attack sequence, and MFA fatigue covers the route that goes through you rather than around you.