Let the customer set it during sign-up as part of the password reset process. You set up your email address and password, let them choose $HOURS for last-line-

Let the customer set it during sign-up as part of the password reset process. You set up your email address and password, let them choose $HOURS for last-line-of-defense password reset. I don't see any perfect answer here. Ultimately you need a way to recover your account when you've lost all of the "somethings you have" and you've lost your "something you know", but then that allows a social engineer access to do the same. So let the user decide during sign-up.