When we can’t verify, we decline access
and the hacker tried a bunch of times and found one agent who didn’t.
How is this possible?
How could he tried multiple times without the account get some sort of a flag or so?
So you say, you have ZERO protection against multiple tries without providing the needed informations?
Gaile’s account (and every other) should get a real big warning that there are tries to take control of the account.
Because you wrote it without some comment, it seems you have no doubt about this insecure procedure.
Also it don’t explain the reports on reddit weeks and months ago with the same method. Your CS-Lead was also aware of it!