Requirement to detect account theft lacking notification of e-mail address or phone number change.

Weakness: An attacker who has control over a user's session can permanently lock the user out without their knowledge due to the e-mail / phone number change process not notifying the victim who can then also not flag the apparent breach to the system owner.

Proposed requirement variations:

• Verify that modifications to account recovery mechanisms trigger out-of-band notifications to existing verified contact methods, enabling users to detect and report unauthorized changes before losing account access
• Verify that email address changes require notification to the previous email address (perhaps for a L3 expansion : include a time-limited mechanism to reverse the change, preventing permanent account lockout scenarios.)
• Verify that when critical account information is modified (including but not limited to email address, password recovery methods, or multi-factor authentication settings), the application sends immediate notification to all previously verified contact methods and provides a mechanism for the legitimate user to report unauthorized changes.