Cooling-off Period: Leaving Time for Discovery After Account Compromise

This article has three layers:

1. Layer 1: The Intuition: Why "waiting a bit" is so useful
2. Layer 2: Real-World Use: Banks, exchanges, Apple account recovery, and smart contract timelocks
3. Layer 3: Principles and engineering key points: What counts as a "change," what can be done during the waiting period, and how to avoid false positives

Layer 1: The Intuition

1.1 The Typical Account Takeover Script

1. The attacker gains access via phishing, credential stuffing, or SIM swapping;
2. Changes the password, binds their own devices or email, and kicks you out;
3. Immediately transfers assets before you even notice.

Step 3 must be fast, because once you discover the breach, you will freeze the account, contact customer service, and attempt to reset the password.

1.2 How the Cooling-off Period Breaks This Script

The rule: As soon as Step 2 occurs, the account can only be viewed and cannot move funds for a certain period, while simultaneously sending notifications to the original email and phone number.

• Normal User: Changes to a new phone; waits a day or two before transferring funds; the only loss is a bit of convenience;
• Attacker: After changing the password, they can do nothing and can only wait; meanwhile, the owner is likely to receive a notification, detect the anomaly, and reclaim the account.

This is the same principle as a bank's policy where "newly added payees can only transfer large amounts after 24 hours."

Layer 2: Real-World Use

Layer 3: Principles and Engineering

3.1 What Events Should Trigger It

3.2 What Can Be Done During the Waiting Period

• Allowed: Viewing, revoking authorizations, freezing the account, and operations moving toward "higher security";
• Prohibited: Withdrawing assets, adding new payout addresses, changing notification methods, or disabling security settings;
• Must be "Cancelable": If the owner uses old trusted credentials to perform any confirmation, the pending change should be immediately revoked.

3.3 Avoiding False Positives

The biggest risk of a cooling-off period is "locking out legitimate users forever." Common pitfalls include:

• Misidentifying routine login methods as changes: If an account normally logs in via an email link, then "logging in via email link" should not count as a change, otherwise the user would be in a permanent cooling-off period.
• Adding devices immediately after setup: Adding a backup credential to a second device immediately after account creation is correct behavior and should be given a brief exemption window.
• Overlapping timers: When multiple changes occur consecutively, the cooling-off period should restart from the last change, rather than using the earliest one.

3.4 Notifications Must Be Sent to "Places the Attacker Cannot Change"

If notifications are sent to the account's current bound email, and the attacker's first step is to change the email, then the notification is sent to the attacker themselves. The correct approach is to send notifications to the old contact methods simultaneously, or to addresses verified during account setup.

3.5 The Recovery Process Should Be Slower

"Recovery after losing all credentials" is the most vulnerable link in all account systems (see Passkeys and Anti-Phishing). The waiting period for recovery should generally be longer than a standard cooling-off period, and any use of old credentials during the recovery period should automatically cancel the recovery request.

Summary