How to improve 2FA security when a hacker has access to the user's email

Question

We have a web app which is used by many companies.

Each user of the web app could work for more than one of these companies.

We want each company to have the ability to enable 2FA for all the users in that company.

This will just be an on/off setting because each user is already associated with an email address and mobile phone number.

When the user logs in with their username/password, as long as at least one company they are associated with, has 2FA enabled, then that user will need to type in the code sent to their phone.

If a user loses their mobile phone, an administrator at the company they work for, can temporarily set it so that the 2FA code is sent to the user's email address. They can then use this to log in, and update their phone number.

The problem is, if a hacker gains access to the user's email address, and password, and manages to convince the administrator (at any company the user is associated with and has 2FA enabled) to temporarily send the 2FA code to the email instead of the mobile phone, the hacker could log in.

Is there a way to improve the security around this?

We could have the option to use a backup phone number (belonging to a trusted friend for example), however where do you draw the line?

Answer 1

Your options when doing multifactor authentication include, broadly: something you know, something you have, and something you are.

As @bradbury9 pointed out, when using email as a backup form of authentication, you are only using 2 variations of "something you know", and 2FA is typically intended to encompass 2 unique forms of auth. If your overwhelming wish is for better security, consider using biometric auth ("Something you are") as your second factor. Since that requires a fair bit of additional effort to set up (and brings in the security vs usability argument), another option is adding a reliable (not something that can easily be OSINT-ed) security question to the email when it is sent ("something you know").

Also, consider sending an SMS to the phone if the email is used as an alternate auth method to notify the individual in possession of the phone (original account user) so they are aware that their account may have been breached. You can also forgo a 2FA app at that point and just use SMS if possible, since SIM-swapping is a bit more difficult than social engineering your way into getting auth sent to an email (this will only work if the reason 2FA is unavailable is limited to the auth app, not if, for example, the user lost their phone).