Account recovery · NIST SP 800-63
A locked-out user asks support to remove two-factor authentication. Pick a case and work the ticket on both sides. On the left, the agent follows a common script that relies on questions about the account. On the right, the agent follows a recovery workflow built on NIST SP 800-63-4. Every question and decision is laid out, so you can follow each workflow from top to bottom.
Outcome comparison
Framework references · NIST SP 800-63-4 (2025)
NIST SP 800-63 is written for US federal agencies. Private companies use it as a benchmark for identity and recovery. It doesn't ban help from a support agent outright: 800-63B-4 §4.2 allows other recovery methods only when they're backed by a documented risk analysis. Asking questions about the account doesn't hold up to one.