You empower support to be convinced over the phone to cancel recurring billing, but not to reset 2FA. That way in the very worst case if support gets socially

You empower support to be convinced over the phone to cancel recurring billing, but not to reset 2FA. That way in the very worst case if support gets socially engineered into removing the credit card details from the account the customer will get mildly annoyed as they have to login and reset it, but their whole account won't be taken over.