I think this is actually a case for delegated authentication, you can quite simply let Facebook(or Google,MS or some other trusted auth provider) handle these things instead of implementing them yourself. Use some form of social login(OAuth2/OpenID Connect)