Improve the UI for things like recovery codes in ways that essentially force users to print them. One thing I've seen out there is asking the user for a recover

Improve the UI for things like recovery codes in ways that essentially force users to print them. One thing I've seen out there is asking the user for a recovery code during the login process a few days after enabling 2FA (with an option to skip it a few times, and generate new recovery codes if the user failed to print them the first time.) Add a waiting period for affected customers, let's say a week or a month. During this period, try contacting the user on all known communication channels (email, SMS, push, robocalls; Coinbase does this quite well for Vault transactions) to inform them about the impending account change. It's certainly not the easiest thing to get right, but it's not asking for too much from a high-profile target like PayPal.