User lost their phone and is locked out by 2FA, how do I reset it?

Server-side with the service role key you can remove the factor:

const { data } = await admin.auth.admin.mfa.listFactors({ userId })
await admin.auth.admin.mfa.deleteFactor({ id: data.factors[0].id, userId })

Run it from a script or a protected admin action, not from the client. After that they log in with just the password and can enroll the new phone.

The identity question is the harder part. Minimum: the request must come from the account's email address, and send a confirmation to that address before you reset.

For the future: Supabase has no built-in backup codes. Common workarounds are letting users enroll two TOTP factors (phone + a second device or password manager), or building your own backup codes stored hashed. Also mention during enrollment that a new phone means re-enrolling.

On identity: an email check proves they control the mailbox, which is the same thing a password reset proves. If your app holds sensitive data, add a waiting period (e.g. 24h, notify the account) before the factor is removed. That stops a mailbox takeover from also becoming a 2FA takeover instantly.