code: protected function disableTwoFactor(BackendUser $user, $return)
  	{
  		// Return if 2FA is disabled already
  		if (!$user->useTwoFactor)
  		{
  			return;
  		}
  
  		$user->secret = null;
  		$user->useTwoFactor = '';
  		$user->save();
  
  		throw new RedirectResponseException($return);
  	}
docs: Disable two-factor authentication
  
  @param BackendUser $user
  @param string      $return