I'm working on improving the security of an application for something much like paying child support. With that said, if the wrong person gains access to our application, it can become very dangerous for the user. Sadly, there have been several instances where an ex or current spouse gained access to an account, or signed up as one of our users.
The biggest challenge is our demographic: many of our users are people who need to protect their information from someone they could be living with, work with, knows quite a bit about them, or still shares a device that can be used to access their account. Additionally, some of our users live in very remote areas, and may lack the means to ever meet with a worker in one of our offices. Without a face-to-face interaction, it's hard for us to be certain who is really creating an account or requesting access.
At the moment, part of our security process includes sending a letter in the mail with a verification code. However, many users hate this, as it can take up to two weeks for them to receive the letter. Additionally, if they're still living with their ex or spouse, there's no way to know which one of them will receive the security code.
In regards to security questions: which questions would a spouse not know? If anyone could guess the answers, it would be them. Also, if the account was created fraudulently, this would only make things worse for everyone.
We also cannot mandate users to meet directly with an employee for verification, as some of our users don't have the means to travel to one of our offices.
When it comes to using SMS and a cellular number, there is still concern that a malicious person will just use their number when creating a fraudulent account, or has access to the user's cellphone.
Without being able to meet with a person, how can you best be certain that they are who they say they are, instead of a well-informed ex, when creating an account or requesting a password/username reset?