Account recovery path

Write the chain down once and it becomes obvious. The advertising account is recovered by the business account; the business account by the mail account; the mail account by a phone number and a backup address; the domain is recovered by the registrar account, which is recovered by mail. Anyone holding the mail account or the registrar holds everything downstream of it, whatever is configured further along.

Two accounts deserve treatment above the rest, and they are the two that are usually forgotten: the domain registrar and whichever mailbox is the recovery address. Compromise of the registrar allows mail to be redirected, which allows every other account to be reset in sequence.

For social profiles the equivalent question is who holds the roles. A business page owned by one person's personal profile disappears with that person — through a dispute, a hack, or simply their leaving. Ownership belongs to a business account with at least two administrators on separate credentials.

A personal mailbox as the recovery address

A founder's personal address is on breach lists, has weaker protection, and leaves with them. Recovery for business-critical accounts should point at a mailbox on the company domain that exists for that purpose, is protected with hardware keys, and is not used for anything else.

Two-factor and multi-factor authentication

Requiring a second proof of identity beyond the password — and the factors differ enough in strength that “we have 2FA” says almost nothing on its own.

---

Business email compromise

Fraud carried out through a real or convincingly forged company mailbox, usually to redirect a payment — and by value, the most damaging attack a normal business faces.

---

SPF, DKIM and DMARC

Three DNS records that together decide whether anyone can send mail pretending to be your domain — and whether your own mail reaches the inbox.

---

Password managers and passkeys

Two mechanisms that remove the human from the part of authentication humans are worst at — remembering secrets, and judging which site to give them to.

All forty-five termsWhat this is regulated by in the UAE

Is this one right in your own numbers?

The definitions are the easy part. Whether the figure on your dashboard was computed this way is a different question, and usually the more expensive one.