[wwn_se]

There is a third option. Most banks here in Sweden solve this by forcing you to show up in person (with a ID card) if you loose your password.

I get that this also is technically a 2FA bypass but the cost is extreme and its really hard to impersonate someone in real life.

[sigmoid10]

How would that even work for internet companies without physical stores? Go to Menlo Park, CA to recover your account?

[stoltzmann]

Facebook already requires verifying your ID in some cases, it's absolutely feasible for them to do it online.

If it's not feasible, I can see an argument that large enough companies should be required to provide in person support options.

Facebook defintely has enough money to facilitate this.

[wasmitnetzen]

There's a lot of online-only banks who have figured this out. Do video auth, outsource it to the postal service, ...