A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the target's account. So they effectively poisoned Amazon's database for their attack, then social engineered their way through.
How can a developer mitigate this specific attack vector, namely the attacker using data they added themselves to gain access?
I had this idea that, for the above example, you would allow the credit card to be added, but the user wouldn't be able to use it for recovery purposes or payment until he clicked a link in his mail to confirm that he wanted to add it, kind of like we already require email verification to create an account. That way, an attacker would have to compromise a second account as well. And of course the customer care rep wouldn't be able to do this himself.