Do I really have to lie on secret questions?

Yes, and that's not bypassing security: it's using it correctly. A secret question is a password disguised as a question; its value depends on no one else knowing the answer. The truth, meanwhile, is often public.

My backup address is ten years old — is that a problem?

It's a real risk. An inactive address can be deleted and then reassigned by its provider, in which case whoever holds it today can receive your reset links. Update it, and remove any recovery methods you no longer control.

Account recovery hijacking

In plain terms

The attacker doesn't try your password: they click "forgot password." Everything then hinges on what the service accepts as proof that it's really you — a secret question, an old email address, a number you no longer have.

Definition

Account recovery hijacking is borrowing the procedure meant for users who've lost access, by satisfying the identity proofs it requires in place of the legitimate account holder.

How it works

Every recovery procedure is a compromise: too strict, and it locks out legitimate users; too lax, and it lets anyone in. The attacker targets that compromise. Secret questions are their favorite target, because the answers — mother's maiden name, city of birth, first pet — often show up on public profiles or can be inferred from an innocuous conversation. Outdated backup addresses are the other door: an abandoned address may have been recycled by its provider and now belong to someone else. Likewise, a phone number returned to a carrier gets reassigned. What's distinctive about this path is that it's perfectly silent from a security standpoint: nothing is forced, the procedure works exactly as designed.

Warning signs

An email announcing a reset request you didn't make
A notification of a change to the backup address or recovery number
A secret question whose answer is publicly findable on your profiles
A backup address pointing to a mailbox you haven't used in years
An account accessible without you having changed the password

How to verify

Open the security settings of every important account and check three things: the backup address, the recovery number, and any secret questions. Verify that the backup address is still yours and that it's itself protected. An abandoned backup address turns the protection into an entry point.

What to do

Treat secret questions like passwords: invent an answer unrelated to the truth and keep it in your password manager. Nothing requires the city of birth to be the real one. Keep the backup address up to date and active, and prefer an authenticator app to a phone number as a recovery method.

If it already happened

Use the service's recovery procedure to regain control, then immediately reclaim the recovery methods themselves: backup address, number, questions, codes. An attacker who has taken over these elements can repeat the maneuver indefinitely, and until they're restored, changing the password is pointless.

Frequently asked questions

Do I really have to lie on secret questions?: Yes, and that's not bypassing security: it's using it correctly. A secret question is a password disguised as a question; its value depends on no one else knowing the answer. The truth, meanwhile, is often public.
My backup address is ten years old — is that a problem?: It's a real risk. An inactive address can be deleted and then reassigned by its provider, in which case whoever holds it today can receive your reset links. Update it, and remove any recovery methods you no longer control.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Credentials and accounts family. Last updated: 2026-09-02.