We have a web app which is used by many companies.
Each user of the web app could work for more than one of these companies.
We want each company to have the ability to enable 2FA for all the users in that company.
This will just be an on/off setting because each user is already associated with an email address and mobile phone number.
When the user logs in with their username/password, as long as at least one company they are associated with, has 2FA enabled, then that user will need to type in the code sent to their phone.
If a user loses their mobile phone, an administrator at the company they work for, can temporarily set it so that the 2FA code is sent to the user's email address. They can then use this to log in, and update their phone number.
The problem is, if a hacker gains access to the user's email address, and password, and manages to convince the administrator (at any company the user is associated with and has 2FA enabled) to temporarily send the 2FA code to the email instead of the mobile phone, the hacker could log in.
Is there a way to improve the security around this?
We could have the option to use a backup phone number (belonging to a trusted friend for example), however where do you draw the line?