2.5.6 Password recovery paths use secure recovery mechanisms¶

Verify forgotten password, and other recovery paths use a secure recovery mechanism, such as TOTP or other soft token, mobile push, or another offline recovery mechanism. (C6)