What is the preferred way to provide a "password reset" functionality for an application installed on a mobile device?
In mobile applications, generally password reset works by sending OTP to the user's mobile. But this procedure seems risky in case the device is stolen. In that case, the attacker could request OTP and change the password and get credentials for the application.
Please suggest ways in which we could remediate this and make "password reset"" functionality secure