Who Can Reset Your Account Without Your Password? Three Strangers, and How to Limit Them

The advice that changed over the past decade was mostly about the password itself: length beat complexity, forced rotation was withdrawn, reuse turned out to be the real problem. All of that is settled and worth following. What the revised advice did not do was change who else can open your account, and that list is longer than most people assume. A support agent working a ticket queue, a clerk in a carrier store, an automated recovery flow that trusts a phone number: any of the three can hand over an account without ever touching the password. That is the party in the transaction most people overlook.

The recovery desk is the real front door

Every consumer service that lets you back in after you forget your credentials has built a second path into your account, and that path is staffed, scripted, and measured on how fast tickets close. The agent on the other end is not careless. They are following a verification script written by someone balancing fraud losses against the cost of locking out real customers who are angry and on hold. Attackers read those scripts too, by trial and error, and they call repeatedly until they reach the agent whose interpretation is loosest. Your twenty-character passphrase is not part of that conversation. The last four digits of a card, a billing address, and a plausible story are.

This is why the practical question is no longer how strong your password is but how thin the alternative route around it has been left. Look at any account that matters and ask what it would take for a stranger to recover it: which email address receives the link, which phone number receives the code, which security questions are still on file, and whether the answers to those questions are facts a determined person could assemble from public records and an obituary. Recovery paths accumulate quietly over years. Most people have never audited one.

The clerk in the carrier store holds your second factor

Text message codes made two-factor authentication ordinary, which was a real gain, and it also moved a piece of your security into a retail job with high turnover. A SIM swap is not a hack in any technical sense: someone walks in or calls in, presents enough identifying detail to satisfy the account verification step, and your number is moved to a device they control. Every code sent by text after that arrives on their phone. The Federal Communications Commission oversees wireless carriers and the rules governing how numbers are transferred between them, and carriers now offer customer-set protections that block a port or a SIM change until an additional secret is supplied.

That protection is off by default at most carriers and takes about four minutes to enable, usually under a menu called port-out protection, number lock, or account PIN. Set it, write the PIN somewhere that is not your phone, and tell anyone else on the family plan that it exists, because a spouse who cannot activate a replacement handset at nine on a Saturday will call the store and ask them to remove it. Better still, move your important accounts off text codes entirely, onto an authenticator app or a passkey tied to the device in your hand.

The first hour, if recovery has been used against you

The signal is usually mundane and easy to rationalize: your phone shows no service in a place it always has service, or an email arrives confirming a change you did not make. Treat both as live events rather than glitches. If the phone has gone dead, borrow another line and call your carrier's fraud department directly, not the store, and say the words "my number has been ported without authorization," which routes the call differently than a general service complaint does. Do that before anything else, because until the number is back, every code the rest of your recovery depends on is being delivered to someone else.

With the number restored or the email confirmed as still yours, work outward from the account that can reset the others. That is almost always your primary email. Change its password, sign out all sessions, and then open the security settings and read the recovery options as if you had never seen them, because an attacker who got in for ten minutes will have added a forwarding rule, a second recovery address, or an app password. Banks and brokerages come next, by phone, with a fraud hold requested verbally. Social accounts and shopping accounts can wait until morning without meaningful additional loss.

What actually narrows the opening

The fixes are unglamorous and they hold. Give every security question a random string stored in your password manager rather than a true answer, since nothing requires the answer to be true and your mother's maiden name is not a secret. Keep one recovery email address that you never use for anything else and never publish. Print the backup codes a service offers when you enable two-factor and put them in the same drawer as the passport, because the reason people fall back on a phone call to support is that they lost the second factor and had no other way in.

Passkeys shorten the whole chain further, replacing the shared secret with a key that stays on your device and cannot be read aloud to a stranger over the phone. Adoption is uneven, but where a bank or a mailbox provider offers one, taking it removes the most persuadable link in the transaction.

The people who staff recovery are doing the job as written, and the job as written has to let real customers back in. What you control is how little that path is willing to accept on your behalf, and every constraint you add there is worth more than another four characters on a password you already never type by hand.