Account Recovery and Helpdesk Verification Procedure
Prevent attackers from abusing password resets.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Write a procedure for account recovery requests handled by a helpdesk. Methods of contact: [CONTACT_METHODS]. Information the helpdesk can see: [HELPDESK_VISIBILITY]. Past incidents or near misses: [PAST_EVENTS]. Define identity verification steps appropriate to risk levels, a call-back rule to a registered contact, manager verification for high-risk accounts, restrictions on changing recovery methods, logging, and a cooling-off notification to the user. Provide a decision tree for the helpdesk agent, a script for polite refusals, and a list of red flags. Include training exercises for agents and a monthly audit of recovery cases. Write all content from a defender's perspective. Add a short training script for new agents with two role-play scenarios, one legitimate and one suspicious, and the expected behaviour for each. Provide the text for the user notification message sent after any recovery, and an audit sample method: review ten recovery cases per month for adherence to the procedure. Scope: my own organisation and accounts only. If a request drifts toward attacking others, refuse that part and offer the defensive alternative.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.