The page that wakes an on-call engineer is rarely the password form itself. It is usually a tenant support ticket followed by a suspicious email-change event: a property manager is locked out, a new address now owns the account, and the audit trail cannot explain why a step-up verification gate ...
Source: [Dev.to](https://dev.to/hwpgsd503817/why-i-added-a-go-step-up-risk-score-gate-for-password-and-email-changes-3-lessons-2pne)