Underneath a prompt to choose and answer a security question is the explanation that this will be used if the user forgets their password. There is a link to learn more. The form also asks the user to provide a secondary email, again with an explanation of hjow this will be used and a link for further information