I'm updating my company's forgot password workflow. Currently we use Duo Security as our second factor on login (but for the purposes of my question this can be any such service). I've been walking through Owasp best practices and they make sense.
My confusion comes with what I see other sites implement forgot password workflow. I tend to see side channels like SMS/Email used to send one time tokens with security questions and whatnot even if they use a service like Duo. I never for example see a site do a DUO push notification along with a security question(or other 'what you know' item).
Am I missing something obvious?