Account recovery

How to protect password-reset flows from abuse

Review recovery message volume, account-existence leakage, proof handling, and final account access separately when protecting a password-reset flow.

By the easycaptcha team · Published April 8, 2026

A password-reset flow can send messages and ultimately change account access. Treat both operations as important boundaries. Protecting login while leaving recovery unreviewed can simply move abuse to a less controlled endpoint.

The recovery boundary

The OWASP forgot-password guidance covers recovery design. A CAPTCHA is only one possible condition around an operation; it does not establish that the requester owns the account.

Protect message creation and account changes separately

Map the request that starts recovery, the verification of the recovery credential, and the final password update. Include alternate API routes and mobile clients. Validate permissions and state on the server rather than relying on a hidden field or frontend progress state.

Control repeated requests using a policy suited to your application. Avoid giving an attacker a way to flood a customer’s inbox or permanently prevent that customer from recovering access.

Preserve privacy in responses

Review behavior for known and unknown identifiers, including timing and side effects. Make public instructions useful without exposing account existence through an unnecessary difference. A challenge can reduce volume without correcting information leakage.

Do not put reset credentials, account passwords, or verification proofs in analytics or support transcripts. Correlate request IDs and operational stages with appropriately restricted records.

Test the full recovery path

Exercise an expired challenge, an unavailable provider, repeated recovery initiation, a stale recovery credential, and successful recovery followed by login. Confirm that a failed verification prevents the intended operation and that a genuine visitor can retry.

Measure recovery completion and message volume together. A fall in requests can mean less abuse or a broken flow. Read account enumeration and rate controls before treating reduced traffic as sufficient evidence that recovery improved.