We stopped sending password reset emails. Support went down.

We had a standard password reset flow: email with a link, valid for 24 hours. 22% of users requested a reset, did not complete it, and requested another within 48 hours. 8% requested three or more.

When we looked at why, the answer was simple: the email took 40 seconds to arrive on average, and users had already navigated away, forgotten, or assumed it failed. They were requesting again before the first one arrived.

We replaced the reset email with an in-session verification: if the user was still on the same device and session, they could reset with a code shown on screen, no email. Email resets dropped 71%, repeat reset requests dropped 84%, and password-related support tickets fell 43%.

What flow in your product depends on an email that arrives after the user has already moved on?