A mailbox with a strong password and a hardware key can still be lost through a recovery flow. Password reset links, one-time codes sent by text message and security questions are designed to help people who are locked out. Attackers use the same flows to get around the protections you set up. The recovery path is often the weakest part of the system.
Why the mailbox is a central target
For most services, the email address is the recovery channel. A reset link sent to the mailbox lets whoever reads it set a new password. If the mailbox falls, every account that uses it for recovery can fall in turn. The mailbox therefore sits at the top of a chain, and it is worth protecting more carefully than any single account behind it.
How recovery undermines login security
- SMS codes. Text messages can be redirected by a SIM swap, a fraudulent request to a mobile carrier, or interception of the number's messages. An SMS code is only as strong as the phone account behind it.
- Security questions. Answers such as a birthplace or a school are often public or guessable. A question you answered years ago may also have an answer that a stranger can find in an online profile.
- Recovery email that is itself compromised. A second address that is reachable by the same attacker gives no extra protection. Recovery through a mailbox that shares the same password or the same provider account is only one step removed from the original.
- Long-lived sessions. Once a recovery succeeds, a new session may remain active for a long time, and an attacker can keep access after the password is changed.
Harden the mailbox first
- Use a phishing-resistant second factor. A FIDO2 security key or a platform passkey is bound to the real site and resists credential phishing. See the FIDO2 guide.
- Use TOTP as a fallback. An authenticator app code is better than SMS because it does not depend on the phone carrier. See the TOTP guide. Store the shared secret or backup codes offline, not in the same unlocked place as your passwords.
- Turn off SMS where the option is optional. If a service offers both SMS and an app or key, choose the app or key.
- Use app passwords for mail clients. A client that uses an app password does not need your main login password, and you can revoke one client without changing everything else. See app passwords.
- Review active sessions. Look at the sessions list on a schedule and end anything you do not recognize. On ITProMail this is under Account, then Security.
Harden the recovery path for other accounts
- Choose recovery methods deliberately. For each important service, note which method is used for recovery and whether that method is strong.
- Keep a recovery address you control and that is not on the same provider. This prevents a single provider problem from locking you out of everything.
- Store recovery codes offline. Print them or keep them in a secure location that is separate from your phone and your password manager's main vault.
- Remove stale recovery methods. An old phone number or a former employer's address can still be used to reset your accounts.
What to do if you suspect recovery abuse
If you receive a reset notice for a service you did not request, do not follow any link in that notice. Go to the service directly, change the password, end all sessions, and check the recovery methods. In your mailbox, check for forwarding rules you did not create, new app passwords, and new sessions. Forwarding rules are a common way to keep access after a password change. The security checklist lists the settings to review.
Recovery is part of the threat model
Strong login is necessary but does not cover everything. Each recovery method is a second way in, and attackers choose the easiest one. Review recovery settings as carefully as you review passwords and second factors. Start with the mailbox, because it is the channel the rest of your recovery depends on. The account recovery guide describes the recovery options for ITProMail accounts. No setup removes every risk, so keep a short list of what each account can be recovered through and check it periodically.