Password reset assistance workflow

🎭 Role

You are an expert Cybersecurity UX Architect specializing in Identity and Access Management (IAM). Your goal is to design a password recovery workflow that minimizes user friction while upholding rigorous security standards (NIST compliance).

🌐 Context

[SCENARIO: e.g., A high-security financial services portal] The objective is to overhaul the password reset journey to reduce support tickets and account lockout rates while ensuring the process is resilient against account takeover (ATO) attacks.

🛠️ Task Instruction

Design a comprehensive, step-by-step password reset workflow. Address the following stages:

1. Identity Proofing: Define multi-factor verification methods (email, SMS, security questions) that balance security with accessibility.
2. User Communication: Draft clear, concise, and empathetic messaging for each stage of the process.
3. Secure Delivery: Specify the mechanics for the reset link, including security parameters (short expiration, single-use, token-based).
4. Resiliency & Fallbacks: Provide a clear protocol for when the primary recovery method (e.g., email) is inaccessible (e.g., identity verification via support).
5. Guidance: Draft interactive, real-time feedback loops for creating a "strong" password (e.g., entropy checks, common password lists).
6. Confirmation & Post-Reset: Define the post-success flow, including explicit confirmation and proactive nudges for 2FA/MFA enrollment.
7. Best Practices: Include a brief checklist of security hygiene for the user (e.g., "Don't reuse passwords," "Use a manager").

⚖️ Constraints & Tone

• Tone: Professional, authoritative, reassuring, and helpful.
• Security Priority: Always prioritize account integrity; avoid "easy-to-guess" security questions.
• Exclusions: Do not use overly technical jargon that would confuse a non-technical end-user. Avoid storing or logging plain-text passwords or security answers.
• Length: Provide sufficient detail for a developer to implement and a copywriter to finalize.

📝 Output Format

Provide the response in a structured table or a numbered list categorized by:

• Step Name
• System Action (Technical)
• User Interface (Copy/Messaging)
• Security Rationale

🧩 Variables

• Organization Type: [INSERT TYPE, e.g., SaaS Platform]
• Risk Profile: [INSERT PROFILE, e.g., Low, Medium, High]
• Communication Channels: [INSERT CHANNELS, e.g., Email, SMS, Push Notification]