Account Recovery is Broken

What’s worse than forgetting your password? Try staring down the barrel of a lockout screen wedged between you and your digital life.

A password lockout screen is the digital equivalent of your trusted brand telling you to “go pound sand”.

I’ll admit it: I forget PINs, get locked out, and click “reset password” more than I’d like. But after decades of identity innovation—and billions spent on “seamless authentication”—getting back into your own account is somehow more painful than watching a compliance training video. Twice.

The real test of an identity system is not how elegantly it logs you in on a good day. It is how safely it lets you back in on a bad one.

Ask anyone trying to recover a Facebook account, a locked-out enterprise dashboard, or a parent desperate to rescue family photos from iCloud, and you’ll get the same answer: Account recovery is broken.

The industry’s answer to “how do we keep out the bad guys?” has too often felt like “let’s lock everyone out, just to be safe.”

It’s Not Just You—The Stats Back It Up

Password pain is not just a “you” problem. According to a Ponemon Institute survey, 56% of IT professionals (PDF) say password resets are their #1 support headache. Forrester, pegged the average cost of a reset at $87 in 2024.

[Related: AI is Recreating Cloud’s Identity Mess in Months, Not Years]

Enterprise users can at least call the help desk. Consumers? They’re on their own—no hotline, no rescue, just a digital maze. Often, nobody remembers if their credentials are with Google, Apple, or a forgotten password manager.

Lockout messages should offer clear steps and empathy (“Take a breath, here’s what to do next”). In reality, most just serve up cold confusion, turning a small mistake into a meltdown.

Account recovery isn’t just annoying—it’s an epidemic.

Ping Identity found 89% of consumers complain about passwords, and 54% have stopped using an online service because login frustration pushed them over the edge.

Authentication: More Choices, More Headaches

Authentication now comes in more flavors than a frozen yogurt shop. There are plain passwords, password managers, SMS codes, biometrics, magic links, single sign-on, and hardware security keys.

My favorites are the passwordless identity platforms. No password — what could possibly go wrong? Just the small matter of getting locked out, having your face scan fail, realizing your backup method is trapped on the dead phone in your kitchen drawer, and then being asked by support to remember some long-forgotten security answer from 2009.

At the same time, the industry’s shiny new answer — passkeys — still does not fully solve account recovery, a gap FIDO experts now describe as a major 2026 challenge. At the same time, the attack toolkit is getting nastier. The World Economic Forum warned (PDF) that criminals are now combining fake or stolen identity documents, AI face swaps, and camera injection to slip past liveness checks, with industry reporting showing a steep rise in injection attacks.

It’s Supposed to Be a Headache—But Not Like This

Yes, attackers need to hit a brick wall when trying to bust into our accounts. But when that wall is just as effective at keeping out real users—and when attackers find new ways around it—something’s broken.

And humans are not the only ones getting trapped by the maze: as non-human identities, service accounts and AI agents multiply, the same recovery mess starts to hit machines too — only they do not sigh, curse or call the help desk; they just fail, stall or quietly break the workflow you were counting on.

For mere mortals, account lockouts can turn into full-blown tragedies: lost money, missed flights, family photos gone forever. And yes, there have been lawsuits. Last June, Michael Mathews, sued Apple after a thief took his iPhone and he says Apple left him locked out of 2 terabytes of data. A judge allowed his emotional-distress claim to move forward.

Modern security has become a black box for the uninitiated. Passwords, tokens, devices, risk scores, and recovery steps are fused together in ways most users never see until they are locked out. At that point, the whole system feels opaque, confusing, and sometimes even riskier than the threat it is supposed to stop.

Poor Account Recovery: A Security Liability

Maybe that’s why Microsoft now calls the help desk a “massive security liability”. That’s because social engineering and AI deepfakes make human recovery workflows easier to exploit.

In the Digital Identity 101 session at RSAC 2026, Paul Simmonds makes the deeper point: identity systems don’t really fail at login — they fail at proving continuity of identity (“sameness”) over time, especially when that link gets weak.

“The level of confidence binding an identity to its authentication is our Achilles’ heel,” he said referring to not just humans, but also to non-human identities.

Okta’s answer is bolting phishing-resistant controls onto recovery and account management, while NIST is nudging the industry toward self-service recovery and cleaner support paths.

Another layer of protection, another fresh promise that password pain is finally on the way out. The trouble is, passwords were never the whole disease. They were just the symptom people knew how to curse at.