>I could change the username if I have access to the email and password. No you can't. Lets say I download a database leak of email/password combos from a pop

>I could change the username if I have access to the email and password. No you can't. Lets say I download a database leak of email/password combos from a popular service. I can't go onto bankofamerica.com or whatever and start iterating through that leak for password reuse, I don't know the username for a given email account. Usually password reset goes something like this: If I click on "forgot password" it asks for username and email address to email me a password reset link. If I click on "forgot username" it asks for email address and other information a financial institution would know, like SSN, account number, credit card number, CVV code. You can't do anything with just email and password. You can't even do anything with access to that email address and password. I just reset my password with Wells Fargo last night and it even gave me security challenge questions from my credit report to change my password (questions like what car did you own, what's the payment amount for your mortgage, what address are you associated with, where does $(relative) live?).