The PUK itself is one such method. An ID is another. Have a separate contact #. And so on. There are many ways, but the essence is to have something out-of-

The PUK itself is one such method. An ID is another. Have a separate contact #. And so on. There are many ways, but the essence is to have something out-of-band. It's really very simple. Generally speaking, there are three classes of auth, who you are, what you have, and what you know. Single factor auth is meaningless, which is why many people are stumped by this situation. Use two factor auth, which is verification from two separate categories. Certain industries use 1.5 auth. There are also software and hardware tokens. Those are generally what you have (and might spill into what you know), but are also time-bound. Ultimately, security is risk-management. Risk can also be transfered, such as by using a different identity provider. Then it is no longer the company's issue to solve.