Are you looking to provide this functionality in authenticated or Un-authenticated space? For authenticated space, it’s simply an update user call from Management API.
For unauthenticated space sending email is easy and best approach. But if you don’t want to send email for password reset. You may need to determine how can you Identify a real user(using personal info combine with OTP), that is the biggest question.