Credential reset order matters

Resetting credentials in the wrong order hands your new credentials to somebody who is still inside.

If the attacker retains access to the system that manages identities, or to the mailbox receiving reset notifications, your recovery becomes their update. The order has to start from a position of established trust and work outward, which is slower and is the only version that works. It is one of the most commonly rushed parts of a response.