What is the best approach on recovering your login account if being hacked or logged in by different user

Question

I'm a beginner in terms of UX. Your thoughts are highly appreciated. I love to discuss related to security with regards to a personal account on the mobile app that contains sensitive or important data/information.

Sample scenario

1. What will you do if your account is hacked, changed the email address, and change password in a new one? What are the best ways for you to perform when you want to recover your Acc?

This my flow Idea for the problem:

1. User can recover the account by putting the old email address (old email address will still be active but not visible on the app)
2. After that user verifies it in the old email and creates a new password for security (Note: user don't need to type the current password)
3. Old email will be back again on the app and disregard the new one.

Let me know your thoughts. Thank you!

Answer 1

Security is a complex issue.

It depends on the importance of the account. A bank account and email have a higher priority than other accounts.

• Reminders questions
• Phone calls
• Password reset by email

Important in this case is the "logout from other devices" function.

the old email address will still be active but not visible in the application

• How will the system know to hide the email?
• When will the location or ip change?
• What if the user travels?

2FA - two factor authorization, so that the system can be sure that it is dealing with the legal owner of the account