Account Recovery as a Security Boundary: A Risk-Adaptive, Layered Architecture for Financial Services

Abstract

Financial institutions have invested heavily in hardening primary authentication through multifactor authentication (MFA), risk-based authentication (RBA), device intelligence, behavioral analytics and phishing-resistant cryptographic authenticators. Account recovery frequently operates at a lower level of assurance than the primary authentication it replaces. The gap is structural: recovery must restore access precisely when one or more enrolled authenticators are unavailable, which creates a persistent tension between security and accessibility. Adversaries who cannot defeat primary authentication increasingly target recovery pathways through credential theft, social engineering, SIM swap and number-port-out fraud, email account compromise and automated abuse of recovery endpoints. This paper argues that account recovery should be modeled as an independent authentication and identity-assurance decision rather than as a customer-service or password-reset function. It formalizes the relationship between recovery assurance and effective account assurance, presents a threat model specific to financial-services recovery, and proposes a layered, risk-adaptive recovery architecture in which identity evidence, authentication assurance, contextual risk and authorization scope are evaluated as separate decisions. The architecture incorporates channel independence, graduated post-recovery authorization, protections for authenticator lifecycle changes, post-recovery fraud monitoring, and resistance to enumeration and automated abuse. The paper also proposes operational metrics for evaluating recovery security and usability. The approach is intended to reduce account-takeover (ATO) exposure without imposing maximum friction on legitimate customers.