3575447 - SAP Customer Data Cloud - REST Call Not Triggered on Expired Link Press in Unknown Location Notification Email

• The documentation indicates that "accounts.REST" is called when the recovery link is pressed in the Unknown Location Notification email.
• However, "accounts.REST" is not called when the expired link is pressed.
• This issue arises during a credential stuffing attack, where the Unknown Location Notification email is suddenly sent to the legitimate user.
• The user may not be able to press the link within the time limit, hence it is believed that "accounts.REST" should be called when the link is clicked, even if the link has expired.

• SAP Customer Data Cloud
• Privacy & Safety (Consent / RBA)

SAP Customer Data Cloud, REST Call, Expired Link, Unknown Location Notification Email, Credential Stuffing Attack, Login Session, Password Reset Link. , KBA , CEC-PRO-PNS , Privacy & Safety (Consent, RBA - Risk-Based Authentication) , Problem