Ask HN: What are good resources for building good 2-factor processes?

As the title says, I'm looking for useful resources on how smart people build strong multi-step authentication processes. Especially looking for how people handle the "real life" issues like people changing/losing their phone number, emergency access, etc - I'm not working in a fully E2E encrypted environment, so the range of possible things I could be doing seems very wide and probably someone else has thought about this more deeply and experienced more edge cases than I can right now.