Account recovery is the front door fraudsters most like to knock on. The agent can guide genuine customers through your self-service reset flows. It cannot reset a password, register a new device or change a phone number or email itself. When self-service fails, a verification system or a trained person decides, and the old contact details are notified.
What is account recovery, and who owns it?
Customers lose access to accounts every day: forgotten passwords, a new phone, a lost device, a changed number, an email account they no longer control. Recovery gets them back in. Account takeover fraud uses the same route: a fraudster posing as the customer persuades support to reset access or switch contact details, then empties the account or uses it to commit fraud.
Security or fraud owns the recovery policy and the verification standards. Support owns the conversation. A specialist team handles recoveries that self-service cannot. The agent's job is to make the safe route easy and the unsafe route impossible, a clear case of the principle in our guide to the AI support agent that knows when to say no.
What are the steps, and who acts at each one?
- Agent, depth 1: identifies the recovery type. Forgotten password, locked after failed attempts, new device, lost access to registered phone or email, or suspected compromise.
- Agent, depth 3: directs to self-service for the type: a reset link sent to the registered email or phone, a device re-registration flow in the app. It sends the link through the system, never to a new address the customer gives in the chat.
- Agent, depth 3: explains each step and helps with errors, such as an expired link or a code not arriving.
- Agent, depth 1: watches for risk signals: contact details changed shortly before, urgency or pressure, inability to answer basic questions, requests to send codes elsewhere, a different country or device from usual, or a third party speaking for the customer.
- Agent, depth 3: starts identity re-verification where self-service cannot work, handing the customer to your verification flow. The flow, not the agent, decides the result.
- Agent, depth 2: drafts the case for a specialist if verification is inconclusive or risk signals are present.
- Person, recovery specialist: decides manual recoveries, including any change to registered contact details.
- Agent, depth 3: confirms what happens next, including that a notice goes to the old contact details where your policy requires it.
- Person, fraud team: investigates suspected takeover attempts.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Identify | Classifies recovery type | 1 | Nothing |
| Self-service | Triggers reset to registered details | 3 | Nothing |
| Help | Explains and fixes errors | 3 | Nothing |
| Signals | Watches for takeover signs | 1 | Nothing |
| Verify | Hands to verification flow | 3 | Inconclusive results |
| Case | Drafts specialist case | 2 | Specialist decides |
| Confirm | Explains next steps | 3 | Nothing |
| Fraud | Nothing | none | Investigation |
Which controls matter, and what evidence does each leave?
No credential changes by the agent. Resetting passwords, registering devices and changing phone numbers or emails are outside its role. Evidence: refused verdicts for any attempt; changes attributed to the customer's own flow or a named specialist.
Links go only to registered details. The agent cannot redirect a reset to an address given in the conversation. Evidence: delivery records showing registered destinations.
Signals are recorded even when recovery succeeds. A pattern across many accounts can reveal a campaign. Evidence: signal records per conversation.
Old details are notified. If contact details change, the previous ones receive a notice. Evidence: notice records.
Verification decides, not conversation. A convincing story is not evidence of identity. Evidence: verification results attached to each manual recovery.
What should you measure?
- Recoveries completed through self-service, and where customers drop out.
- Manual recoveries, time to decision, and outcomes.
- Takeovers traced to recovery, found later through fraud reports. Each is reviewed in full.
- Risk signals raised and how many cases proved fraudulent.
- Customers locked out for long periods, a harm in its own right.
Where does it usually go wrong?
Helpfulness beats policy. The customer is distressed and plausible, so the agent "just this once" sends a code to a new number. It must not have that capability.
Recovery is used to change details. "I've lost my phone, please update my number" bundles two actions. Recovery restores access; changing details is a separate, held step.
Customers who cannot use the standard flow are stuck. People without smartphones, with disabilities or in care settings need another route. Can an AI agent handle accessibility requests? covers offering one without weakening checks.
Recovery is confused with closure. Some customers locked out decide to close or delete the account instead. Those requests need the account holder verified first, as in handling requests to close an account and handling requests to delete an account. A fraudster who cannot get in may try to have the account deleted; can an AI agent delete a customer's account? explains why that stays with a person.
Codes are read out. A customer is coached by a fraudster to read a one-time code to "the bank". The agent must never ask for codes and should warn anyone who offers one.
Where Pryme fits
In Pryme, recovery actions that change who controls an account are never in the support agent's role, so they are refused at the moment of action and filed. Customer statements arrive marked as declared, and only results from your verification system, a sealed source, can support a manual recovery.
Questions people ask
Can the agent lift a lock after too many failed attempts?
Usually it can direct the customer to the standard flow for locked accounts. Lifting a lock outside that flow is a credential action and stays outside its role.
What if the customer has lost access to both their phone and email?
Self-service will not work. The agent starts identity re-verification and, if needed, drafts a case for a specialist. Expect this route to take longer, and say so.
Should the agent tell a suspected fraudster why it will not help?
No. It gives the standard next step and records the signals. Explaining which signal fired teaches the fraudster to avoid it.