It actually should not.

People using a password manager might not ever know their password. Funny things happen with password managers where history is missing, changes don't save, keystrokes break things. We can't penalize users who use them.

It's unfortunately a really messy area.

Source: was a password manager in a past life

That's why it should only raise a flag rather than totally stop. Perhaps the customer service rep can ask a few more questions.

It's a similar situation to someone who only ever uses their credit card to buy small amounts from their local supermarket. Then suddenly they use it to buy a flight in another country. It might be legit, but it's often not, and should suggest that customer service need to do more investigation before approving.

Namecheap has security notifications that inform you of login attempts. https://www.namecheap.com/support/knowledgebase/article.aspx...

This is more about preventing the social engineering attacks. The example you're replying to is where the actual user logged in 20 minutes ago, while the attacker is trying to claim to customer service that they forgot the password. If customer service were looking at login attempts, they would see that it doesn't make sense for the user to not know their password, when clearly they provided it to the site just 20 minutes ago.

I'm aware. This is an isolated comment about other security mechanisms that are in place for the user (not for the support staff).

One of the most frustrating things for support or customer service personnel to do is respond to something other than what was said.