One way of implementing it in the US is what Paypal does, which is assume that your bank has authenticated you, then deposit a couple small random amounts that

One way of implementing it in the US is what Paypal does, which is assume that your bank has authenticated you, then deposit a couple small random amounts that you have to report back. Another way is to charge a fee for last-resort password resets. Charge $10.00 to the user's credit card, if the account info matches, and refund $5.00 in two random small amounts for them to retrieve off their online account statement and report those numbers back to you.