We implemented two custom activities within the workflows - one pulls a user's mobile\email attribute and asks them where to send their OTP and generates the OTP (valid for 60 minutes) the second does the validation and allows them to move forward to the action of pw reset, account unlock, account enable. All happens after they successfully answer all required Q&A questions. These are both custom Powershell Scripts.