Password-Reset 2FA Evidence: SMS OTP, TOTP Apps, and Email Fallbacks

Short answer: for a beginner-friendly SaaS login in the US or EU, SMS OTP is the simplest managed starting point; authenticator apps are stronger, while an email code is a fallback you must build and evidence yourself. The decision is less about a clever factor comparison than about what your compliance file can prove six months later. A password-reset message with a short expiry is a useful test case: the user needs reach, the security team needs an audit trail, and the storage owner needs a defensible retention policy. What is the bill actually made of? Count the work before counting the vendor invoice. With SMS, the recurring unit is a message plus verification traffic, and the operational cost is the evidence around it: destination country, request ID, expiry, attempts, and the final result. An authenticator app shifts recurring delivery cost toward enrollment and recovery engineering. Email looks inexpensive until your team owns code generation, hashing or encryption, expiry, replay prevention, suppression, deliverability, and proof that the right mailbox controlled the session. That is a long list for a “cheap” fallback. For a password-reset flow, retain a salted hash of the one-time code, a five-minute expiry, a one-time-use marker, the account identifier, and a correlation ID. Do not retain the plaintext code or the reset token after redemption. Retention is a security decision: keeping every message body forever creates evidence, but it also creates a second secret store. I would start with a narrow event record, not a transcript. Keep enough to answer “who requested what, when, and what happened?” without keeping the credential itself. Your legal basis and regional policy still decide the exact retention period; I'm not sure a single US/EU number would survive every product and regulator. Keep it boring. Then test the unhappy paths. A resend must invalidate the prior code, a verify attempt must be rate-limited, and an SMS cost guard must stop an attacker f