Researchers Warn of 'Hidden Risks' in Passwordless Account Recovery

**Executive Summary:** Researchers presented findings at Black Hat demonstrating widespread weaknesses in account recovery flows across major websites — including reliance on insecure channels (email/SMS), lack of MFA during recovery, inconsistent verification, active parallel sessions, and the ability for attackers to change recovery methods — which collectively enable account takeover and lockout attacks; they recommend two-factor recovery options, stricter session and device verification policies, and improved support procedures to mitigate social-engineering risks.