I would love for services that I REALLY care about never ever ever being broken into (email, web hosting) there was ONLY the $100-and-speak-to-a-human option to change the password

I would even make it $100 + skype and show live on skype your passport.

Charging $100 is pretty punitive, but I've often wondered why more online services sensitive to attack don't use token credit card charges as a way to limit account duplication, increase complexity in a malicious operation, etc.

Stealing credit cards is cheap, yes, but the additional cost to using such a card on a password reset would still be a deterrent.

And in the real world, no one would use that service. You aren't wrong though, that would be the way to do it if you wanted it to be secure.

That is a PR nightmare...

I wonder if anyone implements the restriction that a password reset can only be ordered after a certain time (a week, say) since the last successful password entry, for long-established accounts. Most real password resets are likely either in long-dormant or recently-created accounts, and this would add just another layer of partial protection against these kinds of attacks.

Whoa. I hadn't realized this. So someone that knows my email address and has my phone has access to my entire life, because all password resets use my email address.

If it's come to this, to using "something you have", then we can all go back to using paper password notebooks. They offer the same security, surprisingly.