Skip to main content

​
Real-World Example

Sarah, a user at ABC Collections, forgets her password. She opens the Forgot Password page and enters her work email address. If the email is associated with a valid creditor account, the system sends a password reset link. Sarah opens the password reset link, enters a new password, confirms it, and saves. After the reset, the old password should no longer work, and the new password should allow successful login.

​
Visual Flow

​
How It Should Work

  • The user must request a password reset using their registered email address.
  • The system must send a password reset link when the account exists and the request is valid.
  • The password reset link must be valid, unexpired, and associated with the requesting creditor user.
  • The reset page must require a new password and confirmation.
  • The new password must meet the system’s password requirements.
  • A successful reset must invalidate the previous password and the used reset link.
  • After reset, the user must be able to log in with the new password.

​
How It Should Not Work

  • The system must not reset a password without a valid reset request.
  • The system must not accept an expired, invalid, or previously used reset link.
  • The system must not accept a weak or unconfirmed new password.
  • The system must not reveal private account details during the reset request.
  • The system should rate-limit repeated reset requests.
Last modified on July 30, 2026