&gt; For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session.<p>Why not reauthenticate by sending a one time password by email&#x2F;SMS (instead of asking for a password)?<p>&gt; Combo of email &amp; SMS.<p>Good idea. I was also thinking of sending one time passwords through some chat applications like WhatsApp, but most of them have no API for such a thing (except Telegram).