No matter what, there are reasonable hypotheticals where you get angry and take your business elsewhere. The difference is my approach has you leave because you're angry at the signup page, and your approach has you leave because someone stole your stuff. I'll take my approach any day of the week.
For something as important as the credentials for a bitcoin exchange account, as Alex gave as his example, there should be policies specifying the reasons why account credentials can be changed and what evidence must be presented to do so. Front-line customer service reps shouldn't be flying by the seat of their pants when making difficult decisions with potentially hundreds of thousands of dollars on the line.
The point of social engineering attacks is that they’re innocuous requests that don’t raise suspicion, and are hard to train people against.
- Functions to get the account based on the email address
- Internal tools
- Stored procedures and other SQL stuff that happens outside the main code base
- Third-part integrations (Mailgun, Sailthru, ZenDesk, SalesForce, etc.)
That’s a huge attack surface where if there is even a minor mistake by a junior dev that no one noticed then everyone is going to lose their assets under protection.
I've only once had my email address rejected by a website (for ending with an underscore), but I never bothered setting up another email just for them.