I'm by now means an expert in this field, or even well versed, but if it's possible to do this, I can't comprehend how Paypal allows it.
Say you have 2 factor authentication on, with your phone setup as the Device.
You lose your phone and someone finds it. They quickly open the email, they see you have a Paypal account, they decide to access it.
They go on Paypal, click "forgot password". Paypal gives a few options to confirm you're the owner:
- have them call you
- answer security questions
- receive an SMS text with a confirmation Code
The person already has your phone, they go for the SMS option. They get the SMS text with the code, reset the password, and they're in.
Really? That's it? Losing the phone you use for 2 Factor Authentication basically means you can have a stranger quickly go into your account if they find it?
This is so blatantly stupid...In case one wants to reset the password, questions should always be asked, no matter if they got the 2 FA device or not.