Using Machine Learning to Analyze and Predict Password Reset Factors

Large companies spend millions of dollars annually on password resets. While a lot of research has been done on the influence of password strength and memorability on resets, little public research has examined factors beyond just the password itself. In order to identify which factors most influence password resets, this study investigated device type, days since last login, and account age. The type of password reset was also categorized into four types: reset without trying, meaning that the user had not recently attempted a login before resetting; tried and failed, meaning that the user had attempted one login before resetting; and forced reset, meaning that the user had two or more failed login attempts, resulting in a subsequent password reset. Analyzing 200,000 rows of data revealed that newer accounts (8-31 days old) and those accessed from a mobile device were more likely to initiate password resets. It was also found that resetting without trying was the most common type of password reset in both desktop and mobile devices. Using this predictive model, organizations can preemptively address password reset issues, improving user experience and security while reducing company costs.