I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to reset the password within a limited amount of time.
I would like to add an additional step before allowing customers to reset, such as a security question (http://www.troyhunt.com/2012/05/everything-you-ever-wanted-to-know.html). My question is what is best practice, using today's security standards, for situations where the customer can't answer the security question?
Does the system prompt them for some other secure info tied to their last order, such last 4 digits of their credit card? (If yes, what if the customer hasn't placed an order yet?)
In my situation, I would need the entire process to be able to be done online (vs by phone - although, I would be curious to know what the benefits are using phone). We don't want customers not being able to place orders if they can't get through to customer service.