Profile Update: Email Change, Verification Email

When using Users API,the /api/v1/users/{{userId}} endpoint to update a users email /login, the change is committed without any verification email sent to a new email.

I understand that this is not an OOB functionality. Is there a way to achieve this? what are the best practices for it?

My guess is through the use of event hook or inline hook…but would appreciate any advice around this.