Please don't use recovery Q&A.

As a user, I cannot trust that a website gets the recovery flow right. Some websites will allow you to bypass email and password if you know the answer to the question. Because of that, I cannot put in the real answer, as that would be a massive security risk.

So I usually put in some random garbage, which means it's essentially a second password. Well, if I lost my first password, chances are good that I lost the second password as well.

So please, don't do security questions. Just send a password reset link by email.

If you're worried about stuff like payment info stored in the account, just ask me to re-enter those details after I changed my password.