Self-service recovery works best with an email address. Phone-only accounts still need OTP or an administrator-assisted recovery flow.
Enter the same email address or phone number used during registration. For better security, the response stays generic even when an account is not found.
Encourage users to register with an email address so reset links can be delivered securely.
Without SMS or WhatsApp OTP, a phone number alone cannot support safe self-service password recovery.