Password Reset Flow
Self-service link sent OR manual reset processed with verification audit. Suspicious activity escalated where present. User confirmed access restored.
Before you start
- Self-service password reset working
- Identity verification protocol for manual reset
- Suspicious-activity monitoring
- User email and verification details
- Recent login history
- Account type and admin status
The steps
- Direct user to self-service first — Reply with the self-service reset link and quick instructions. 80% of password requests are solved with self-service. Link directly to the reset page, not the help center home.
- Investigate self-service failures — If the user reports the self-service flow doesn't work, check: (a) is the email correct on file? (b) is the email landing in spam? (c) is the account in any locked state? Don't immediately do a manual reset — diagnose first.
- Verify identity before manual reset — If manual reset is needed, verify identity via secondary channel: another verified email, signed in via SSO, security questions, or admin confirmation if account is on a team. Never manually reset based on a single unauthenticated request.
- Check for suspicious activity — Pull recent login attempts, failed login geography, and account flag status. Sudden flood of failed logins from unusual location = potential account takeover. If suspicious, escalate to security team before reset.
- Issue manual reset and notify the user — Trigger a temporary reset link from the auth admin. Send to the verified email. Confirm with the user that it arrived. Force password change on first login (don't leave the temporary in place).
- Log the manual reset for audit — Log: requestor email, verification method used, agent who processed, timestamp, IP if available. Manual resets are an attack vector — auditing matters.
If it goes wrong
Social engineering attempt successful
Tighten verification protocol. Never accept identity claims based on tone or urgency. If in doubt, refer to a documented secondary factor — not judgment calls.
User loses access to email used for reset
Follow the documented account-recovery escalation path. Typically requires admin-level verification including billing match or signed legal document.
MFA reset bypasses MFA on the account
MFA reset is a separate, higher-friction flow with stricter verification. Password reset never auto-removes MFA — must be a separate explicit action.
All OpenLabor playbooks