A lot of sites offer 5 or 10 recovery codes as the backup mechanism if the user loses access to their primary 2FA (usually a phone number). Can we just simply use a backup email address instead, or a backup phone number? After verifying their primary email and password, we would email/text their backup with a code that they have to verify. What are the pros and cons of this recovery method?

1 Answer 1


The whole point of 2FA is to require the second factor to login. Usually - password+token, in recovery situation - password+recovery key. Something you know + something you physically have.

If you can use secondary email as a recovery option for 2FA, the user account is protected by their password + the recovery email password, thereby defeating the goal of 2FA. The attacker will just go through the easier route.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .