Forgot Username/Email - Do extra credentials equal enough to log the user in?

Question

I am working with another UX guy and he's let me know that there have been some studies surrounding the fact that when a person goes through a "forgot username/email" process, they enter in extra information and that this extra information should be enough for a user to be logged in without having to enter a password.

In our case, the user has two options - either enter their phone number, last name and DOB then receive a text message (or call) to confirm; OR they can enter social security number, last name and DOB.

Then the next step is to answer their security question (1/3 questions). If they answer this question correctly, they move on to a logged in state in their account. No password necessary.

Is this common practice these days? Is this still relevant for a financial company? Can a user just keep doing this as another option to log in?

I have a feeling that all of the information needed to log in can be found in the user's email. Assume their email address has been hacked... We require the same information for forgot password as well, though the password is something that users inherently make secret. Everything else can be found fairly publicly, unless they don't answer the security questions properly on purpose (like I do)

EDIT: My suggestion: I believe to retrieve information, a person should have something that only they know (not written on paper ANYWHERE), security information (assuming they used it to sign up [SSN, DOB]) and a piece of physical information (In this case, a debit/credit card number that they physically possess). This seems like the most secure way to get into an account. thoughts?

Answer 1

No, don't make password reset based on anything submitted in a form. You need to determine the users identity through a method besides your own website. Either via two factor authentication (usually phone) or via a known email address. The danger here is brute forcing, guessing, or stealing the data needed for a password reset. Yes, it is often quite possible to maliciously aquire a user's ssn, dob, and phone number. Stealing their phone or compromising their email is often far, far harder. Also, be very careful about storing or asking for the users ssn - this can be treacherous, especially if an attacker manages a man in the middle or sql injection attack.

Stick with e-mail Auth or two factor Auth for password resets.