VANKPA
The decision
Account recovery is part of the core mobile experience. Users need a clear route when they lose a password, change a device, or no longer have an old contact method. Design recovery alongside login rather than leaving it as a late support problem.
In practice
A field worker replacing a broken phone may need access before starting a job. The recovery process should protect the account while explaining the next step. Avoid messages that reveal whether someone else's contact details belong to an account.
- Test recovery links, expiration, repeated requests, and the return to the app.
- Define the escalation path for unavailable email or phone access.
- Make support responsibilities and identity checks explicit before release.
When to take the next step
Design recovery when the login model is chosen. Test with someone using a replacement device so the team sees the full route back to useful work.
Questions clients ask
Should recovery happen inside the app?
It can, but the complete path must work across the channels used to verify access.
What should support be able to do?
Only the recovery actions permitted by the agreed security and identity process.