> It’s probably worth faking having lost your 2FA and asking for it to be reset.

I'm not sure I trust that I'd be as good an attacker as a professional, and there's not a great way to replicate "hang up, call again" approaches likely to work with a big org.