Also, recovery codes can only be used once, and every usage triggers a notification to the user and potentially a signal for internal risk analysis systems.