Re: What else can you use that doesn't rely on unreliable recall.
You could perhaps rely on unreliable recall itself.
Phone asks questions. Attacker answers. Real owner can't remember the answers to some of the questions. Add a touch of magic AI powder to detect patterns in the failure to answer and you have a recognition system.
I think I left my phne in my coat pocket ---->