Request a secure, single-use recovery link
For privacy, the response is the same whether or not an account exists. Staff must still complete two-factor verification after resetting a password.