Verify MFA Recovery Paths
Test account recovery when an MFA factor is lost without letting support or backup codes bypass normal identity checks.
MFA can stop an account takeover only if recovery does not offer an easier path around it. A lost device, inaccessible passkey, or exhausted backup codes should have a clear owner-controlled recovery process. NIST SP 800-63B discusses authenticator lifecycle and invalidation; the service must translate that guidance into its own support and identity-provider flow.
Inventory every recovery route: backup codes, secondary factors, administrator reset, help desk, and identity-provider recovery. A route that exists only in a provider console may still affect application access. Do not publish operational recovery secrets in a general runbook.
Recovery decision tree
| Situation | Required check | Outcome |
|---|---|---|
| User has a second enrolled factor | Verify it under normal flow | Restore access without downgrade |
| Backup code used | Consume once and notify | Enroll a fresh factor |
| No factor remains | Apply higher-assurance recovery | Hold until identity verified |
| Admin reset requested | Independent approval and audit | Time-bound reset path |
| Suspicious request | Stop and escalate | No account grant |
Avoid security questions based on public facts. Require the recovery operator to see the account, request channel, and risk signals without exposing private data to a caller who has not been verified. After recovery, invalidate old factors and sessions according to the provider's actual behavior.
Owned account test
Create a synthetic account with two factors and backup codes. Use one backup code and verify it cannot be reused. Remove a factor through the approved recovery flow and check the audit event, notification, and new enrollment requirement. Try a recovery request from an unverified contact and require a hold. Test that ordinary sign-in still works with a valid remaining factor.
Record steps, provider receipts, and decisions without capturing codes or authenticator secrets. If the identity provider owns recovery, inspect its policy and application session behavior rather than assuming the app can override it. A recovery process is not ready when the only documented path is "ask an admin to turn MFA off." Keep emergency access separate from routine user recovery.
Make offboarding verifiable
Use the offboarding checklist to identify owners, revoke grants and verify the result. Discuss a scoped review of your application's access controls.
Sources
- NIST SP 800-63BAccessed
- OWASP Application Security Verification StandardAccessed