You have a friend called Bob.

You have a copy of Bob's passport.

Bob uses 2FA for all of his accounts.

Would you, in general, be able to bypass this 2FA and access his accounts, by doing the following:

  • Emailing support

  • Explaining to support that you lost access to your account

  • Sending support a copy of Bob's passport, claiming that you are, indeed, Bob

Would it be fair to say that the majority of support agents would reset 2FA on Bob's account?

New contributor
Martin S is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Let me rephrase your question: by stealing someone's identity, could you convince help desks to give you control of someone's account? Uh, yes. But that depends entirely on the help desk's processes and verification procedures. Your focus on "passports" is weird because no service I use where I've enabled 2FA has ever seen my passport. Why the focus on passports? – schroeder Mar 26 at 9:45