Overview

Description

Losing access to a community account should not mean losing years of contributions, friendships and membership history.

One of the most common frustrations for community administrators is members reporting that their password-reset emails never arrive. Messages may be rejected, filtered into spam, blocked by email providers, or sent to an email address the member can no longer access.

Traditional password recovery offers little help when the original email address is unavailable. Members become locked out, create duplicate accounts, or contact administrators directly requesting password or email changes.

Member Recovery provides a structured alternative to the standard password-reset process.

Members can submit a recovery request using a new email address they control, identify their original account, and communicate with administrators through a dedicated recovery case.

Administrators receive a centralised workspace for investigating requests, reviewing available email-delivery evidence, and following an ownership-verification process before authorising recovery.

Members should generate and securely store their recovery codes in Account Settings while they still have access to their accounts.

This provides an established verification method if they later lose access to their original email address.

Key features

• Alternative account recovery: Dedicated recovery forms for missing password-reset emails, inaccessible email addresses, forgotten login details, and other sign-in problems.

• Native IPS integration: Provides recovery assistance through the existing login and lost-password interfaces without replacing their native functionality.

• Verified replacement email addresses: Members supply an accessible contact address and must verify control of it before proceeding.

• Member recovery codes: Generate, regenerate, and revoke recovery codes through Account Settings. Codes are displayed once, stored as hashes, and consumed individually.

• Protection against fraudulent requests: Account information and historical details are supporting evidence, never automatic proof of ownership.

• Staff approval controls: Configurable approval requirements, including additional protection for administrator and MFA-protected accounts.

• Email-delivery diagnostics: Investigate available mail failures, blocked addresses, sender configuration and transport issues without claiming to guarantee inbox delivery.

• Centralised administrator dashboard: View recovery statistics, open cases, outstanding investigations and retention information.

• Private recovery communication: Exchange messages through protected recovery cases, with separate internal notes for administrators.

• Duplicate-account assistance: Identify possible matching accounts and previous recovery activity without automatically merging accounts or treating matches as ownership proof.

• Controlled password and email recovery: Following successful verification and approval, issue a short-lived, single-use completion link to update credentials and invalidate existing sessions.

• Security and privacy: Granular administrator permissions, rate limiting, encrypted sensitive information, case histories and configurable data retention.

• Automated maintenance: Scheduled cleanup and runtime diagnostics help administrators maintain the recovery system.

An important distinction

Member Recovery does not simply allow administrators to reset passwords because somebody has emailed them asking for help.

It creates a controlled recovery process designed to help legitimate members regain access while reducing the risk of account takeover through impersonation or informal email requests.

The public recovery system requires administrator activation. Members must have enrolled recovery codes beforehand to complete the application's ownership-verification process.

Recover accounts with greater control, clearer evidence and stronger safeguards.

ACP > Members > Member Recovery