Require 2 identity questions  Last name, account number, email, DOB  Enforce lockout policy Ask one or more good security questions  https://www.owasp.org/index.php/Choosing_and_Using_Security_ Questions_Cheat_Sheet Send the user a randomly generated token via out-of-band  app, SMS or token Verify code in same web session  Enforce lockout policy Change password  Enforce password policy
{}