Maya had been with the company for three years. She was organized, careful, and never fell for phishing emails. She thought her accounts were secure.
One Monday morning, she got a text. Her personal email password had been reset. She didn't request it. By the time she opened her laptop, her personal inbox was gone. Someone else owned it.
The attacker didn't guess her password. They used her account recovery options. Her backup email was an old address she hadn't checked in years. Her security questions? Her high school mascot and her mother's maiden name. Both were on her Facebook profile. It took the attacker about ten minutes.
Maya's account recovery settings were outdated and easy to exploit. The attacker used her publicly available personal information to answer her security questions and redirected the recovery email to an address she no longer controlled. Account recovery is designed to help you get back in. But if it's not set up carefully, it helps attackers get in instead.
Your personal email is often the recovery address for your work accounts, banking, shopping, and cloud services. If someone takes over your personal inbox, they can reset passwords for almost everything else. Outdated recovery options are an open door. Most people set them up once and never look again.
Check your account recovery email address. Make sure it's an active inbox you control and check regularly.
Remove security questions if you can. Many services let you replace them with a phone number or authenticator app. That's always the better choice.
If security questions are required, use a fake answer. Treat it like a second password. Store it in your password manager, not your memory.
Review your recovery phone number. Make sure it's your current number, not an old one.
Do this for your work account, personal email, banking apps, and any account that holds sensitive information.
Open your personal email account settings right now and find the recovery or security section. Confirm the backup email and phone number are current. If you see security questions, check whether you can replace them with something stronger.
Recovery email is active and one I check regularly.
Recovery phone number is my current number.
Security questions use answers that cannot be found on social media.
I have not reused recovery answers across multiple accounts.
I know how to report a suspicious password reset to IT.
Set a reminder once a year to review your account recovery settings. Treat it like updating a smoke detector battery. You do not think about it until you need it, and by then it is too late.