## TL;DR
Verify the user's identity through your standard process first, then in Okta Admin go to Directory > People > the user > Security Methods and remove the lost factor. The user re-enrolls at next sign-in. Never reset MFA on a phone call without identity verification.

## The error
```text
(User lost their phone or authenticator app and cannot complete MFA.)
```

## Steps
1. Verify identity per policy: employee ID, manager confirmation, or a video check. Expected: identity confirmed and logged in the ticket. This is the security-critical step; do not skip it.
2. Okta Admin > Directory > People > the user > Security Methods. Expected: the enrolled factors are listed. Remove only the lost factor (e.g. Okta Verify on the old phone), keep the rest.
3. If the user has no working factors left, click "Reset" on the authenticator to force re-enrollment. Expected: status shows enrollment required.
4. Have the user sign in; Okta prompts for new factor enrollment. Expected: user enrolls the new device successfully.
5. Confirm the user can sign in end to end, then close the ticket noting the identity-verification method used. Expected: clean audit trail.

## When to use
- Lost phone, wiped device, or broken authenticator
- User locked out of all MFA factors

## When not to use
- Push not arriving on a working phone (troubleshoot push first)
- Enrolling a second factor for the first time

## Compatibility
- Okta Identity Engine; requires admin rights to user security methods

## Variants
### User is traveling and unreachable by normal channels
Escalate per policy; do not lower the verification bar because the user is in a hurry. Urgency is a social-engineering signal.
### Admin cannot see Security Methods
The admin role lacks the needed permission. Use a role with user-factor management rights.

## Why it happens
MFA binds to a device. When the device is gone, the binding must be broken administratively and rebuilt. The identity check exists because this flow is exactly what an attacker would abuse.

## Edge cases
- Executives and IT admins: require stronger verification (two-person confirmation is common).
- Service accounts with MFA: reset via the service owner, not the on-call agent.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_SCLJsAWwJkAK-k0OaTDizA