you're removing something which people basically understand the concept of - passwords: keep them fucking secret/safe - and trying to replace it with something that is built on top of a system never meant to work that way. If your system routinely sends out OTP emails, all it takes is someone to intercept those emails on their way from your SMTP server out to the wider internet, and every fucking user is breached.
The only reason password reset links are at all acceptable is because they are used relatively rarely and it's not predictable when they will be used.
The only reason password reset links are at all acceptable is because they are used relatively rarely and it's not predictable when they will be used.