Lost TOTP 2FA, recovery declined: how to recover a GitHub-linked team member account?

Hi, I'm the owner of a Pro team. One of our team members lost access to her authenticator app (TOTP 2FA) and has no recovery codes. Her account is a Hobby account with no payment method. It is linked to her GitHub account, and she has always signed in to Vercel through GitHub.

What she has tried

26 September: the Account Recovery Form. No reply.
Signing in with GitHub and with email: both land on the 2FA screen, which only offers "Use a Recovery Code Instead" and "Start 2FA recovery". There is no option to verify with the linked GitHub account.
9 October: "Start 2FA recovery" opened case TNS_012Aa7d36q5eC3Uv. Trust and Safety asked for the team, some projects and card details, and she answered (the account never had a card). On 10 October they declined: ownership could not be verified.
12 October: as team owner, I asked Support through our Pro team. The answer was that Support cannot escalate 2FA or recovery cases, and that the only path is an appeal through the Account Recovery Form.

What she can prove

She passes the email one-time code for the account's address.
She controls the linked GitHub account and can publish any token you ask for (gist, repository or commit).
In September she transferred projects from her own Hobby scope into our team, and she has been a member of the team since then.
As team owner, I confirm the request is legitimate.

We do not want a new account or a different sign-in method: her GitHub sign-in, her team membership and her project history are all on this account.

Our questions

Is the GitHub-linked identity verification flow, which staff have mentioned in other threads, available for her account? If so, how does she reach it when the 2FA screen does not show it?
What evidence should her appeal include so that it is not declined again for the lack of a payment method?

Could someone from the Vercel team take a look at case TNS_012Aa7d36q5eC3Uv? Thank you.

Hi there! I'm just a bot here to share some info that might help you before a human arrives.

If your account is eligible, you can use our new self-service recovery flow:

Go to vercel.com/login
Choose to sign in using the email + one-time password (OTP) option.
Select Use another sign-in method
Verify your identity using the GitHub, GitLab, or Bitbucket account previously linked to your Vercel account
Follow the remaining prompts to complete the recovery process

If you've ever set up a passkey, possibly on another device, you can use that to get back into your account and update 2FA settings yourself. You can also use recovery codes if you've stored those in a safe place that you can still access.

If you are unable to access your account using the steps above, you can open a support case using the Start 2FA recovery option on the Two-Factor Authentication login screen. Please do not publicly post account details, like your email address, that could help an attacker gain access to your account in the future. There's no need to open an additional case if you already have one open.

Thanks for your patience while the team works to resolve all cases as quickly as possible while keeping everyone’s accounts safe and secure. A human should be here soon to help.

Thanks. We tried exactly this flow on 9 October: after signing in with email and the one-time code, the 2FA screen only shows "Use a Recovery Code Instead" and "Start 2FA recovery". There is no "Use another sign-in method", so the GitHub verification is not offered for this account, and the case opened through "Start 2FA recovery" (TNS_012Aa7d36q5eC3Uv) was declined on 10 October. She will retry the flow once more and we will add a screenshot of the 2FA screen here. We would appreciate a human looking at the case.