TL;DR: For Node.js event notifications, send transactional email first, poll its delivery status, and use SMS fallback only while the password-reset token remains useful. The deciding constraint is the expiry clock: a late fallback can create noise without helping a locked-out customer. For a customer-support system, this is a reliability problem with a security boundary. The useful outcome is not “an API accepted a request.” It is a reset message that is observable, bounded by its expiry, an...