Recommended Account Recovery Practices for FIDO Relying Parties

In 2019, strong customer authentication is expected to ramp up rapidly, driven by support from regulatory initiatives such as Payment Services Directive 2 (PSD2), industry standards such as those from FIDO Alliance and the World Wide Web Consortium (W3C) and also through platform vendors. But adoption will be limited without mechanisms to recover accounts when authenticators are lost. The entire ecosystem is only as strong as the weakest link, so account-recovery mechanisms and policies must be clearly defined. These approaches need to provide secure and acceptable user experiences. This document briefly summarizes recommended practices for all service providers (also referred to as Relying Parties or RPs), including banks and merchants.