[ncarroll]

FB has great face recognition software and multiple tagged photos of pretty much everyone who has an FB account. Show 20 photos (or 42 or however many you need to get the chances of a lucky guess small enough) and let me - click on me. Give me 2 chances and if I'm wrong both times give a link for a quick video chat with a FB rep for ID purposes.

[kalleboo]

They already have an "identify 5 photos of my friends" system for some account lockout situations. But that may not be sufficient if the hacker has already had access to the account for a while (they'll have had time to scrape the user's friends list).