BAD assumes: 1. you got login credentials at GOOD 2. you're using the same email address there They then tell you GOOD will send you a code that you have to

BAD assumes: 1. you got login credentials at GOOD 2. you're using the same email address there They then tell you GOOD will send you a code that you have to enter on their website. Then they enter your Email on GOOD and request a reset, which sends a mail with a code to you. You then enter the code on their website. Now that they have the code they can enter it on GOOD and they have your account.