Q:

What if user can't answer the security question during password reset?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to reset the password within a limited amount of time.
I would like to add an additional step before allowing customers to reset, such as a security question. My question is what is best practice, using today's security standards, for situations where the customer can't answer the security question?
Does the system prompt them for some other secure info tied to their last order, such last 4 digits of their credit card? (If yes, what if the customer hasn't placed an order yet?)
In my situation, I would need the entire process to be able to be done online (vs by phone - although, I would be curious to know what the benefits are using phone). We don't want customers not being able to place orders if they can't get through to customer service.

A:

Security questions are usually stupid and useless. They rely on information that is usually easily obtained through a quick Internet search of the target's social media accounts and is not a good way of proving identity.

Does the system prompt them for some other secure info tied to their last order, such last 4 digits of their credit card? (If yes, what if the customer hasn't placed an order yet?)

The last 4 digits of a credit card is not secure information either. See a recent, well-known case of social engineering that exploits precisely this.
Personally, I'd just fire of a password reset email to the listed email account and be done with it. Any other steps will generally serve to annoy your customers more than protect against any real threat.

A:

This will depend somewhat on how much security you need.
You mention you are an e-commerce site; do you store customer credit cards for "one click" style ordering? If not, I expect the impact of account breach is relatively minor, so you can probably get away with a relaxed password reset process. For example, simply sending a reset link to the stored email address, without any security questions.
If you do allow "one click" ordering then you may have certain controls to limit the risk of this, such as only shipping to the card's billing address, and a relaxed password reset process may still be appropriate.
If you truly need high security on accounts, then you must have a strong password reset process. The strongest of all is to have in-person enrolment where you capture biometrics, and an in-person password reset process where you verify the biometrics. In practice that is only done by a few governments of developed countries for passport or national ID schemes. And at that point, we wouldn't be relying on passwords, right?
Another approach is risk based transactional analysis. So, you may normally have the policy that you will ship to any address. However, if the account has recently (say, last 7 days) had a password reset, then you only ship to the billing address.

