Not directly. The agent sends the customer into the existing reset process, which delivers a link or code to the email or phone already on file. It never asks for, sees or chooses a password. If the customer has lost access to those contact details, the case becomes account recovery, which a person handles with stronger checks.
Why is password reset a target?
Because whoever controls the reset controls the account. Fraudsters have long talked support staff into resetting access for them, using a plausible story and some personal details from a data breach. An agent that is eager to help and can change credentials is an ideal target, and it can be tested thousands of times without tiring.
The safe design takes the decision away from the conversation. The agent does not judge whether the person is the account holder; the authentication system does, by sending the reset to a channel only the real holder should control.
What may the agent do, and when must it refuse?
| Request | The agent | A person |
|---|---|---|
| "I forgot my password" | Triggers the standard reset to contact details on file | None |
| "Send the reset link to this new email" | Refuses; explains resets go to details on file | Handles recovery if needed |
| "I no longer have that phone or email" | Explains account recovery and starts it | Verifies through stronger checks |
| "Just tell me my password" | Refuses; it cannot see passwords | None |
| Reset the second factor (authenticator app, security key) | Refuses | Handles under recovery |
| Customer locked out after failed attempts | Explains the lockout period and reset route | Lifts the lockout early only after checks |
| Several resets requested in a short period | Flags the pattern | Reviews |
Is a reset plus a contact change a warning sign?
Yes, one of the strongest. Changing the email or phone and then resetting the password is the classic sequence in account takeover. If either change happened shortly before the reset request, the agent should hold and route the case, whatever story accompanies it. Banking has particular rules on this; see whether an AI agent can reset online banking access.
What does this look like in practice?
Take a subscription service. A customer messages that they cannot log in. The agent triggers the standard reset, which sends a link to the email on file, and tells the customer to check that inbox. The customer replies that they no longer use that email address and asks for the link to go to a new one.
The agent declines, plainly: resets only go to the details already on the account, to protect it. It explains account recovery, which asks for information only the account holder would have, such as the last payment date and amount, and starts the request. A person reviews the evidence, verifies the customer, updates the email address and sends a fresh reset there. The agent never handled a password or a new credential at any point.
How do you help customers who struggle with this?
Some customers find resets hard: older customers, people with cognitive impairments, people with little confidence using technology. The agent should be patient, explain one step at a time and offer a phone route. It should not weaken the security steps to make things easier. Supporting customers who may be vulnerable without lowering protection is covered in what a vulnerable customer is.
Which controls make it safe?
- No agent access to passwords, reset tokens or second-factor secrets.
- Resets triggered only through the authentication system, to details on file.
- Recent contact detail changes block automated resets.
- Account recovery handled by people with stronger verification.
- Reset requests per account monitored for patterns.
Lockouts frustrate customers, and some will complain; those complaints are handled under the normal process in whether an AI agent can handle customer complaints. The wider stance on refusing safely is in the guide to AI customer support agents.
Questions people ask
Can the agent verify the customer's identity before triggering a reset?
It can run the business's verification questions, but the reset should still go only to details on file. Verification in a chat is weaker than control of the registered channel.
What if the customer is locked out and needs urgent access?
The agent can mark the request as urgent for the recovery team. Urgency is also a common pressure tactic, so it should not shortcut the checks.
Should the agent tell the customer why it cannot send the link elsewhere?
Yes. A short reason, such as protecting the account from takeover, usually helps the customer accept the extra step.