Account recovery
Requests to reset two-factor authentication from users who lost their device and codes.
This is the highest-risk decision in the console
Approving hands an account to whoever submitted these photos. Compare the selfie against the ID already on file in the KYC record — not against the ID uploaded here, which an attacker also controls. If anything does not match, reject.