Reply: Account Access, Locked Out or Password Reset

Purpose: help a customer get back into their account safely, without ever weakening security.

Use it when: a customer cannot log in, forgot their password, is locked out, or lost access to their two-factor method.

Goal: the real account owner is back in, through the official process.

Version: v1.0

Before you send

Message comes from the email address on the account? (If not, verification is needed first)
Account status checked: active, locked, suspended, recent security changes
Any signs of takeover: recent email or password change the customer did not make, unusual logins, new devices
Client's verification and recovery process ready

The flow

1. Personal line and the action

You: Hi (CUSTOMER FIRST NAME), Sorry you're locked out. I've just sent a password reset link to the email on your account. It works for (NUMBER) minutes.

Why it works: the fix is already done in the first two lines.

2. If it does not arrive

You: If it isn't there in 5 minutes:

Check your spam, junk or promotions folder.
Search your inbox for "(BRAND NAME) password".
Reply here and I'll send a new one.

3. Security reminder

You: For your security, our team will never ask for your password by email, chat or phone. Best, (YOUR NAME)

Why it works: teaches the customer to recognize phishing, and protects the client.

If they write from a different email than the one on the account

You: Thanks for reaching out. To protect your account, I can only send reset links to the email address already on the account. Could you reply from that address? If you no longer have access to it, I'll guide you through our identity check.

Then follow the client's identity verification process exactly. Never change the account email until verification is complete.

If they lost their two-factor device

You: I can help with that. Because two-factor protects your account, getting back in needs a short identity check: (CLIENT'S STEPS). Once that's done, we'll reset your two-factor so you can set it up on your new device.

Follow the client's process. If it requires Tier 2 or the client, escalate and give a timeframe.

If there are signs of account takeover

You: Thanks for letting us know. I can see some recent changes on your account that you may not have made. I've (SECURED ACTION FROM CLIENT PROCESS, for example locked the account) to protect it, and our security team will contact you by (TIME AND ZONE) to help you get back in safely.

This is Urgent. Escalate immediately per the Escalation Ladder. Do not discuss account details until the owner is verified.

Objections and tricky replies

Customer says	You reply
"Just tell me my password."	"I can't see or share passwords, which keeps your account safe. The reset link lets you choose a new one in a minute."
"Change my email to this new one, it's urgent."	"I'll help, and I need to confirm it's really you first. Here's the quick check: (STEPS)."
"I'm the owner's assistant/partner."	"I can only make account changes for the account owner. They can contact us directly, or add you as a user if the account allows it."

After you send

Internal note:

Issue: locked out. Checked: request from account email (yes or no), no takeover signs. Done: reset link sent. Promised: none. Next: none (or verification pending).

Tags: account access. Status: Solved, or Pending if verification is needed.

Never do this: never change an account's email, phone, password or two-factor settings, and never share any account details, until the client's identity verification is complete. Skipping verification is an automatic QA fail and the most common way accounts are stolen through support.