When someone has lost access.
WHY IT IS DELICATE
It is the exact scenario an attacker presents.
WHAT TO ESTABLISH
What proof is sufficient.
WHAT GOOD PROOF LOOKS LIKE
Access to the registered contact address Payment details matching records Information only the holder would have
WHAT WEAK PROOF LOOKS LIKE
A plausible story Documents that could be fabricated Knowing publicly available details
WHAT TO DO WHEN THE REGISTERED CONTACT IS LOST
Require more, not less.
WHY
It is the commonest attack pattern.
WHAT TO CONSIDER REQUIRING
Verification against payment records A delay, with notice sent to the existing contact
WHY THE DELAY AND NOTICE
It gives a genuine holder the chance to object.
WHAT TO NEVER DO
Change a contact address on a single request without verification.
WHAT TO DOCUMENT
The evidence accepted, and who approved it.
WHAT TO ESCALATE
Anything you are unsure about.
WHY
The cost of a wrong decision is far higher than a delay.
WHAT TO TELL A LEGITIMATE CUSTOMER
Why the process exists.
WHY
Most accept it readily once they understand it protects them.
WHAT TO PROVIDE
A clear list of what you need.
WHAT TO AVOID
An indefinite process with no criteria.
