Account takeover
An account can become controlled by someone who possesses its accepted assertions but is not the assigned participant.
Account takeover may follow credential theft, phishing, password reuse, recovery abuse, session theft, malware, social engineering, or administrative compromise. Existence research asks whether accepted account authority should remain sufficient when the separately maintained existence condition is absent. The EAID does not replace the account credential.
What is taken over
The attacker seeks the system’s ability to act as the account.
The practical target may be a password, authenticator enrollment, recovery channel, session, token, trusted device, delegated role, or support process. Once the system accepts the substitute, the attacker may inherit access, reputation, data, privilege, and transaction capability.
The account record can remain internally consistent while the real human relationship has changed. Existence introduces a separate source of current truth.
Identity continuity
Systems often preserve account continuity by accepting replacement evidence.
People forget credentials, replace devices, change contact information, and lose authenticators. Recovery is necessary. The same flexibility creates a path through which an attacker may convince the system to accept new evidence for an existing identity.
A separately assigned existence relationship can be required at selected recovery or enrollment decisions, but the organization must design an exception path for legitimate loss. That exception must not quietly recreate the same unverified assumption.
After takeover
The attacker may change the account so future access appears ordinary.
Contact details, recovery methods, devices, credentials, forwarding rules, permissions, payment destinations, or delegated access may be altered. Monitoring may see valid activity from a now-modified account rather than an obviously invalid login.
Existence can make high-impact account changes dependent on the original assigned participant’s current relationship while that relationship remains valid and uncompromised.
verify_existence(...)Recovery, device enrollment, privilege change, sensitive disclosure, and transaction functions can request the current result before committing change.
Stolen sessions
Account takeover does not always require ownership of the long-term credential.
An attacker who obtains an active session may act under existing authority until the session expires or is revoked. The account may still have strong MFA and an uncompromised password while the session itself has been displaced.
A protected action that requires both valid session authority and current existence can deny the attacker when the assigned participant’s independent relationship is absent.
Physical and coercive limits
Existence is not invulnerable merely because it is separate.
A stolen EAID alone must not provide account access because the organization still requires its own credential. If an attacker compromises both the credential and EAID, controls the endpoint after private arrival, coerces the participant, or compromises the existence infrastructure, the existence result may not distinguish the harmful use by itself.
Hardware protection, activation integrity, revocation, administrative controls, monitoring, and incident response remain necessary. The system must preserve the difference between disabling a relationship and destroying the historical evidence that it existed.
Account recovery
Recovery must restore a legitimate relationship without allowing indirect assertions to become unquestioned authority.
A sound recovery process may require independent organizational verification, delay, notification, human review, previous-device evidence, or controlled reissuance. Existence can be one input when the original EAID remains available, but cannot be the only path when the device is genuinely lost.
The scientific principle is not that recovery is impossible. It is that every replacement step should state what fact it actually establishes.
What existence does not replace
Presence does not repair identity governance or determine whether account activity is legitimate.
It does not replace credential protection, MFA, recovery security, anomaly detection, fraud controls, session hardening, notification, support training, or rapid revocation. A present participant may willingly delegate access or maliciously misuse the account.
The bounded contribution is that an account’s accepted assertions need not remain sufficient for selected consequences after the assigned participant’s current relationship is absent.
The separate truth source
The account describes recognized authority. Existence describes whether the assigned participant’s current relationship remains present.
Takeover seeks to make the first fact appear valid under someone else’s control. Requiring the second fact at consequential decisions creates another dependency the attacker must satisfy.
Continue the examination