Account recovery

Account recovery is the way back in when you have forgotten your password or lost your phone. A backup email, a security question, a code sent somewhere else.

It is worth thinking of it as a second front door, because that is exactly what it is. If the main door has a good lock and the back door opens with your mother's maiden name, the quality of the main lock has stopped mattering. Attackers know this and go straight for the weaker route. Whatever protects your account properly should protect the way back in just as well.