Embodiments include apparatuses, methods, and systems for performing security protection of association between a user device and a user. A computing system receives from a service provider a notification that an identifier of a user device has been activated in the user device to be associated with a user identifier to replace an existing identifier of the user device associated with the user identifier. The computing system further receives from the user device a request for information associated with the user identifier to be sent to the user device associated with the identifier of the user device. Before sending the requested information to the user device, the computing system verifies the identifier of the user device has been activated by the user by an additional authentication of the user through a communication path between the user and the computing system. Other embodiments may also be described and claimed.