Let us review the basic access control corning stones with their pros and cons relating to your case of device theft:
Something you know
Referring to passwords, passphrases, PIN codes, secret questions.
It can be a hard time for the thief to "crack" this factor as is, especially if you enforce a strong policy.
You can mitigate the concern of resetting the password through an email using a challenge (e.g strong secret question, perhaps recent activity based) as a must step for the password reset.
Where did you make your recent payment? to whom?
This is considered to be the weakest factor among the others I will mention, and indeed in case of theft, it will be easily changed without the abovementioned mechanism.
Something you have
A physical token that your application can scan using RFID, NFC, etc.
Provides a higher level of security as long as the token is not near the device itself
Pricey, perhaps overkill. User experience might be bad as well.
Something you are
Biometrics; fingerprint, iris scan, voice analysis, behavioral analysis (continuous authentication)
Considered to be the strongest factor, industry standard, most of today's devices have this hardware in place for you to utilize.
Biometric authentication has its errors; false rejection of the user and acceptance error of an unauthorized entity (e.g: printed picture, looked alike person, etc)
you can enforce a strong secret questionnaire upon sensitive operations (transactions, password reset requests, etc), you can add a physical token or verify the client upon sensitive operations based on biometrics