Can I still get back into my account when iris authentication fails?

Let's assume a banking app that uses iris authentication. You lose your phone, or it keeps failing to recognize you. When something that usually takes a few seconds gets blocked, finding a way to get back in becomes more urgent than the accuracy of the authentication itself. When I hear about new implementations, I start by looking at this 'what happens next' part.

The recovery screen is, after all, just another entrance. If standard authentication is robust but the process for registering a new device requires much weaker verification, the protections you've built up can become meaningless. I'm not saying banks actually operate this way, but it's a design issue that can arise when you prioritize normal login while treating recovery as an afterthought.

NIST's digital authentication guidelines include an item stating that alternatives to biometric authentication should always be provided. This doesn't explain the obligations of Korean banks or the implementation of a specific iris service. Still, I found it a worthwhile standard for considering that a system design must include scenarios where biometrics cannot be used.

NIST SP 800-63B-4 §3.2.3 (excerpt). These are U.S. digital identity guidelines and do not represent regulatory requirements for Korean banks or the implementation of any specific service.

Does getting rid of all other methods make things safer? Even legitimate customers who lose their phones could end up locked out of their own accounts. I’m interested in what is being verified to grant access again, rather than just whether recovery is easy or hard. Simply attaching more recovery paths like SMS or email doesn't mean the problem is solved.

The approach introduced by FIDO in 2020 focuses on reducing the need for recovery by registering multiple authentication methods in advance. If that’s not possible, it suggests re-performing the initial identity verification process. This does not mean any specific bank supports this right now. In my view, it's only useful if there's an explanation of when and how one can register and change these backup methods. If you tell someone to prepare only after a problem has already occurred, it's too late.

Notifications about recovery events and contact points for when you didn't initiate a request must also be viewed as part of the same package. The NIST guidelines cover this as well. Can the user get back in on the day they lose their phone while ensuring unauthorized individuals can't easily get in? My thought is that adoption shouldn't be decided based solely on days when the iris scanner works perfectly.