At one of the companies that I worked for, the absolutely worst-case scenario was if someone emailed in about forgetting their email and had also never saved their back-ups codes for two-factor authentication (2FA) and had since changed their phone number or method for two-factor authentication. We had a workaround that would sometimes work to get them some of their content back but, for the most part, it was lost and gone to their access. Somehow we had to find a delicate way to tell them that both conveyed that we understood how painful it was, but that they needed to save those backup codes in the future.

It was easily one of the more difficult emails that we had to write.

Most customers responding asked for us to bend the rules a bit or let them into their account temporarily, so in our tactic, we focused on why 2FA was valuable and how implementing it was meant to be an act of security. We then went on to explain how letting someone into their account without the information needed by 2FA would be doing exactly the opposite of what they had set it in place to do. We also worked hard to let the customer know that we understood how painful this was, and didn’t want them to feel high-and-dry — that’s when we introduced the workaround that would at least help them get some of their content back.

This is a fairly complex situation like most password reset emails are, but if you are lucky and just get an email from someone who has forgotten their password and needs to reset it, you can either reset it for them or teach them to reset it themselves. An example of what the latter email might look like is:

Hi there,

Thanks so much for emailing about this — that’s a great question!

You can reset your password by heading to [insert instructions for where they need to go and what they need to do to reset their password here]. Once you do that, you should see a confirmation notice in your email that it’s worked.

Let me know if you run into any trouble, but otherwise, have a great rest of your day.

Thanks!