Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Does anyone know of a good alternative to the Forgot Password link on login forms? I'm not looking to eliminate the link, but to provide an alternate method for retrieving lost passwords.

Our current process works like this: 1. User clicks on "Forgot your username or password?" link, which appears below the Username and Password fields on our login screen; 2. A panel opens below this link asking the user to provide her email address; 3. A reminder email is sent to the validated email address, which contains a reset link.

The trouble is that many users don't remember which email address they used to register. Entering an unrecognized email address will pop an error message. So, I was wondering if it might be helpful to ask for an email address or a phone number? If a recognized phone number were provided, a text message could be sent to the user's phone with the reset link.

This alternative might help reduce the number of calls our customer service reps have to answer each day about lost passwords. But I haven't seen this phone/email pattern used before.

Any thoughts, pro or con?

share|improve this question
    
Popping up a message on entering an unregistered e-mail address is revealing information you may not want revealed (to someone trying to hack into your site or a specific user's account). Just report that an e-mail has been sent to the given address. If the address does not exist or is invalid - nothing will happen and no information is inadvertently revealed. –  Marjan Venema Aug 15 '12 at 7:14
    
Good point, maybe we'll eliminate that error message. –  RobC Aug 15 '12 at 22:18
    
I'd keep the address. It's much more likely that a person will mistype email address. Getting an "all is well" notification from the site would help someone make that mistake. Sometimes it can take up to 3-6 minutes for an email to be received legitimately, so a person might make the mistake and then sit around waiting for an email that never comes. –  Mirov Nov 24 '12 at 19:05
add comment

2 Answers

up vote 3 down vote accepted

I think you would be able to do this. In fact twilio can handle the reset password by voice if they don't have text.

share|improve this answer
    
Interesting. Do you know how reliable it is? Voice recognitions still seem to suffer from low quality. –  Anna Rouben Aug 14 '12 at 21:12
    
@AnnaRouben I'm not sure if we're on the same page, but not authenticate the voice of the user, but have the system call and tell them the reset password. I've tested it before and the voice is pretty clear. Around the quality of Siri. –  Travis Pessetto Aug 14 '12 at 21:51
add comment

I think it depends on which user information your company collects from the users. Do you collect account recovery questions or alternate email addresses? You could for example ask for the alternate address and if there is a match ask for more information; for example, expose the last digits of the phone number and ask to provide the rest. Unfortunately our technology world didn't come up with the ideal identity solution yet. For the customer service reps, I would recommend giving them a quick ability to reset user's password. Usually service reps cannot know the new password or ask users for passwords so an auto generated reset password link can be sent to the user's email.

share|improve this answer
    
We don't ask for security questions, or alternate email addresses. Phone numbers are optional. Fortunately, the customer service reps can reset user's passwords. –  RobC Aug 15 '12 at 22:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.