An unfamiliar delivery address appears in a shopper’s account. Minutes later, an order confirmation arrives for something they never purchased. They try to sign in, but their password no longer works.

For the consumer, this is an urgent problem: stop the misuse, recover access, and understand what happened. For developers, it exposes a gap between building a login screen and building a service that remains useful when that login is compromised.

This article examines recovery from a business-to-consumer perspective: what an individual shopper needs, and how developers can translate those needs into safer interfaces and backend controls.

1. Understand what the consumer is trying to recover

Account takeover and identity theft can overlap, but they are different problems.

Account takeover means someone has gained unauthorized control of an existing account. Identity theft involves misuse of someone’s personal information.…