I am working with another UX guy and he's let me know that there have been some studies surrounding the fact that when a person goes through a "forgot username/email" process, they enter in extra information and that this extra information should be enough for a user to be logged in without having to enter a password.
In our case, the user has two options - either enter their phone number, last name and DOB then receive a text message (or call) to confirm; OR they can enter social security number, last name and DOB.
Then the next step is to answer their security question (1/3 questions). If they answer this question correctly, they move on to a logged in state in their account. No password necessary.
Is this common practice these days? Is this still relevant for a financial company? Can a user just keep doing this as another option to log in?
I have a feeling that all of the information needed to log in can be found in the user's email. Assume their email address has been hacked... We require the same information for forgot password as well, though the password is something that users inherently make secret. Everything else can be found fairly publicly, unless they don't answer the security questions properly on purpose (like I do)
EDIT: My suggestion: I believe to retrieve information, a person should have something that only they know (not written on paper ANYWHERE), security information (assuming they used it to sign up [SSN, DOB]) and a piece of physical information (In this case, a debit/credit card number that they physically possess). This seems like the most secure way to get into an account. thoughts?