For any operation that could permanently lock a user out or enable full account takeover, require the user to prove their identity again with their current password:

• Changing email address

• Changing password

• Disabling or changing MFA

• Adding or removing payment methods

• Deleting the account

• Viewing or exporting sensitive data

A valid session token proves you were authenticated sometime in the past. Re-authentication proves you're the legitimate user right now.

Banks do this instinctively: you can check your balance with a saved login, but to wire money you re-enter your PIN. The session getting the balance isn't the same trust level as the session moving your money.

Re-auth stops token theft from escalating to full takeover. It doesn't stop an attacker who already has the victim's password (from credential stuffing). For those scenarios, MFA is the answer.