Most important lesson as far as reducing vulnerability to social engineering is concerned: whatever service we subscribe to - we should always find out about th

Most important lesson as far as reducing vulnerability to social engineering is concerned: whatever service we subscribe to - we should always find out about their account retrieval process. In other words, we should always ask "what is the password retrieval process for the new account you just opened?" This sounds like a big task and one where not all scenarios can be covered. But I think this is a good first step - as long as we are still dealing with passwords, federated identity, half-masked credit card #'s and security questions. I think this exercise would help us be careful about our choice of passwords, answers, email ids. What would be the most obvious downsides to this approach?