Losing the phone that holds your authenticator app feels like losing the keys to your entire digital life. Your password still works — but the six-digit code that stands between you and your email, bank, and crypto accounts is gone. The good news: in most cases you can get back in. This guide walks you through exactly how, service by service.
Quick Answer: What Should You Do First?
If you lost the phone with your 2FA app, use a backup code to sign in, then immediately re-enrol a new device. If you have no backup codes, try any second method you registered earlier (SMS, a backup email, a security key, a passkey, or a trusted device you’re still signed in on). If none of those work, submit the provider’s account recovery form and expect a wait of 3–14 days while they verify your identity.
Recovery is almost always possible if you set up a fallback before the loss. That’s the part most people skip — and it’s why this guide ends with a prevention checklist you should complete today.
Why Losing Your Phone Locks You Out at All
Authenticator apps don’t fetch codes from the internet. When you scanned that QR code during setup, your phone stored a secret key. Every 30 seconds, the app combines that secret with the current time to produce a fresh code — a process defined in IETF RFC 6238, the TOTP standard.
That design is a security strength: no network call means nothing to intercept. It’s also the reason a lost phone is a hard lockout. The secret lived on that device, and unless you backed it up or saved recovery codes, it’s gone with the phone. If you’re new to how any of this works, start with our beginner’s explainer on what two-factor authentication is and how it protects you.
Before You Panic: 5 Things to Check First
- Are you still signed in anywhere? Check your laptop, tablet, work computer, or an old browser session. An active session is a live door into your account settings, and it costs nothing to look.
- Did you print or download backup codes? Search your downloads folder for filenames containing “backup” or “recovery”, check your password manager’s secure notes, and look through any printed documents you filed away.
- Can you get your phone number back? If the account also has SMS as a fallback, your mobile carrier can usually port your number to a new SIM within a day.
- Do you have a second authenticator? Many people set up both an app and a hardware security key years ago and forgot about it.
- Is the phone actually gone, or just broken? A cracked screen device may still boot to a mirrored display, and a wiped-but-recovered phone may restore the app from an encrypted cloud backup.
Step-by-Step: How to Recover a 2FA-Protected Account
Step 1 — Start the sign-in and look for “Try another way”
Enter your username and password as normal. On the code prompt screen, look for a link labelled “Try another way”, “More options”, “Can’t access your authenticator?”, or similar. This reveals every alternative method registered on the account — often more than you remember setting up.
Step 2 — Use a backup code
Backup codes are single-use strings issued when you first enabled 2FA. Enter one exactly as shown, without spaces. Each code works once and then goes dead, so cross it off your list immediately.
Step 3 — Sign in from a trusted device
If you previously ticked “don’t ask again on this device”, that machine may let you in with just your password. Once inside, go straight to security settings.
Step 4 — Remove the old 2FA method
The moment you’re back in, delete the authenticator entry tied to the lost phone. If the device was stolen rather than misplaced, whoever has it may still be generating valid codes for your account. Revoking that entry closes the hole.
Step 5 — Re-enrol on a new device
Set up 2FA again from scratch. This generates a brand-new secret, which is exactly what you want. If the old handset still works, our guide to moving Google Authenticator to a new phone is the quicker route. If you’re rebuilding on a phone you don’t fully trust yet, you can generate codes in your browser using our free online authenticator at 2fa.bd to confirm the setup works before you commit.
Step 6 — Download the new backup codes
Do this immediately, not later. “Later” is how people end up reading articles like this one.
Step 7 — Audit every other account
The lost phone probably held codes for a dozen services, not one. Work through them methodically — email first, then banking and crypto, then everything else. Our guide on setting up 2FA on Binance covers the pattern most exchanges follow.
Recovery Options by Service
Every provider handles lockouts differently. Here’s what to expect from the major ones:
| Service | Primary recovery route | Typical wait |
|---|---|---|
| Backup codes, then the account recovery form | Minutes to 5 business days | |
| Microsoft | 25-digit recovery code, then the recovery form | Minutes to ~24 hours per attempt |
| GitHub | Recovery codes, passkey, security key, or verified SSH key | Instant, or 3–5 days for review |
| Apple | Trusted device, trusted number, or recovery key | Instant to several days |
| Crypto exchanges | Identity verification with photo ID and a selfie | 2–14 days, withdrawals often frozen |
| Banks | Branch visit or verified phone call | Same day to a week |
Google accounts
Google lets you sign in with a saved backup code as your second step, and you can generate a fresh set of ten at any time from your security settings. Their official pages on signing in with backup codes and fixing common 2-Step Verification problems cover the full flow. Note that accounts enrolled in Advanced Protection have stricter rules — a backup security key is generally required.
Microsoft accounts
Microsoft issues a single 25-digit recovery code rather than a list of short ones, and it’s stored in your security dashboard. See their guide on getting a Microsoft account recovery code. If you’re locked out entirely, the automated recovery form is the only route — support agents cannot bypass MFA for you.
GitHub accounts
GitHub is unusually explicit about the stakes: if you lose both your 2FA credentials and every recovery method, access is permanently gone. Their documentation on recovering an account after losing 2FA credentials lists the accepted fallbacks, including passkeys, security keys, and previously verified SSH keys.
Crypto Exchanges: What to Expect After a 2FA Reset
Exchanges are the strictest category of all, because a fraudulent reset means stolen funds that cannot be clawed back. Expect full identity verification, and expect a hold on withdrawals even after you’re back in. Binance’s own support documentation describes a 48-hour restriction on withdrawals and related services following a 2FA reset — deliberately, so an attacker who does manage a reset cannot drain the account before you notice.
Plan around that delay rather than fighting it. If you have an open position or a pending transfer, the withdrawal freeze is the part that will actually cost you, not the reset itself.
What If You Have No Backup Codes at All?
You can still recover most consumer accounts without backup codes, but the process shifts from automated to manual. Providers will ask you to prove ownership through indirect evidence.
To improve your odds, submit the recovery form from a device and network you’ve used with that account before, answer from the email address originally tied to it, and be precise about details like the account creation date, previous passwords, and recent activity. Guessing wildly hurts you — a partial correct answer beats a confident wrong one.
One practical detail people overlook: recovery systems often weigh your IP address and location against your normal pattern. Submitting a recovery request from an unfamiliar country or a VPN exit node can trigger extra friction. You can check what the service sees by visiting our What Is My IP Address tool before you file the request.
Be patient and avoid hammering the form. Repeated failed attempts frequently trigger a cooldown that resets each time you try again, which makes things slower, not faster.
How to Make Sure This Never Happens Again
The US Cybersecurity and Infrastructure Security Agency is blunt about the value of MFA — it dramatically reduces the chance of an account takeover. The goal isn’t to use less 2FA. It’s to build a fallback so that 2FA protects you instead of trapping you.
1. Save backup codes properly
Store them in an encrypted password manager, and keep a printed copy somewhere physically secure — the same place you’d keep a passport. Never paste backup codes into an online notepad, a cloud document, an email to yourself, or a chat app. That includes our own online notepad tool, which is built for quick drafts, not secrets.
2. Register two independent second factors
An authenticator app plus a hardware security key is the strongest common pairing — security keys meet the highest authenticator assurance levels recognised in NIST’s digital identity guidelines (SP 800-63B). Two authenticator apps on two different devices also works. The principle is simple: no single lost object should lock you out.
3. Choose an authenticator with encrypted backup
Modern authenticators can sync your secrets across devices with end-to-end encryption, which turns a lost phone into an inconvenience instead of a crisis. We compare the leading options in our roundup of the best Google Authenticator alternatives.
4. Keep recovery contacts current
An old work email or a phone number you gave up three years ago is not a recovery method. Review these annually.
5. Do a lockout drill
Once a year, pick one important account and try to recover it deliberately. You’ll discover broken fallbacks while you still have a working one.
Frequently Asked Questions
Can I recover my 2FA if I lost my phone and have no backup codes?
Yes, in most cases. You’ll need to use the provider’s account recovery form and verify your identity through other means — a recovery email, phone number, previous password, or photo ID. Expect the process to take anywhere from a few hours to two weeks depending on the service.
Will a new phone automatically restore my authenticator codes?
Only if your authenticator app supports cloud sync and you had it enabled. Restoring a phone backup does not always carry authenticator secrets across, because many apps deliberately exclude them from standard device backups for security reasons.
Can someone use my lost phone to access my accounts?
If the phone has no screen lock, yes — the authenticator will keep generating valid codes. This is why you should remove the old 2FA entry from every account as soon as you regain access, and why a strong device passcode matters as much as the codes themselves.
How long do backup codes stay valid?
Backup codes generally don’t expire, but each one can only be used once. Generating a new set immediately invalidates the old set, so make sure you replace your stored copy whenever you regenerate.
Does resetting 2FA leave my account temporarily less secure?
Briefly, yes — which is exactly why many platforms impose a waiting period or freeze sensitive actions like withdrawals immediately after a reset. It’s a deliberate trade-off designed to stop an attacker who forces a reset from taking over the account in the same session.
Should I turn off 2FA to avoid getting locked out?
No. Disabling 2FA trades a manageable inconvenience for a serious risk. A password alone can be phished, leaked in a breach, or guessed. The right fix is a second recovery method, not less security.
Are passkeys a safer alternative to authenticator apps?
Passkeys are phishing-resistant and remove the code-typing step entirely, and they sync across devices through your platform account. They’re an excellent primary method — but you should still register a fallback, because losing access to the platform account that holds them creates the same lockout problem in a different shape.
Can I use an online authenticator instead of a phone app?
Yes. A browser-based TOTP generator produces the same codes defined by the same standard, which is useful when you’re on a desktop or setting up a replacement device. Treat the secret with the same care you’d give any credential, and keep your backup codes stored separately.
What should I do first if my phone was stolen rather than lost?
Treat it as a security incident, not just a lockout. Remotely wipe the device if you can, contact your carrier to suspend the SIM, then prioritise recovering your primary email account — because whoever controls that email can reset most of your other accounts.
The Bottom Line
A lost phone is recoverable. A lost phone with no fallback is a much longer, more painful story. If you take one action after reading this, make it the boring one: open your two most important accounts right now, generate fresh backup codes, and store them somewhere you’ll actually find them again.
When you’re ready to set up a replacement, you can generate TOTP codes instantly in your browser with our free online 2FA authenticator — no app install, no account required. You’ll find more security walkthroughs on the 2fa.bd blog, and you can read about who we are and how we handle your data on our about page. Found a security issue on our site? Please tell us through our security disclosure page.
14 Responses