When we design secure systems there is always a tension between memorability, security and cost (e.g. Calls to a call centre).
Until recently, I've always tackled this by getting users to set up security questions during registration (first dog's name, etc).
This seems a bit quaint and outdated now, when there are so many ways to verify identity online, yet it still seems the most prevalent pattern. What is the best in class solution right now?
Criteria 1. There MUST be a way to recover username and/or password digitally as first resort, before calling customer care
Criteria 2. The question covers both desktop and mobile but the solution doesn't necessarily have to be the same for both