Losing 2FA access is more common than it sounds. Knowing your recovery options before it happens makes the difference between a 5-minute fix and a multi-day lockout.
Scenario 1: You Lost Your Phone
See our dedicated guide: Lost Your Phone With 2FA — What to Do.
Short version: use backup codes, recovery email, or recovery phone number to log in. Change passwords immediately. Reconfigure 2FA on your new device.
Scenario 2: You Deleted Your Authenticator App
If you deleted the app but still have the same phone, try restoring the app first:
- Google Authenticator: Reinstall → sign in with your Google account → your backed-up tokens should restore automatically (if backup was enabled)
- Authy: Reinstall → log in with your phone number → tokens restore from Authy's encrypted cloud backup
- Aegis/Raivo: Reinstall from backup file if you made one, otherwise use backup codes
Scenario 3: Your Phone Was Factory Reset
Same as losing your phone — all local TOTP tokens are gone. Recover each account using:
- Backup codes (fastest — if saved)
- Recovery email verification
- Recovery phone number verification
- Service support (slowest — requires identity verification)
Scenario 4: Your Codes Are Wrong But the App Is Fine
Your device clock has drifted. Fix it: Settings → Date & Time → enable automatic. See: 2FA Codes Out of Sync — How to Fix.
Prevention: Set Up Before You Need It
- Enable cloud backup in your authenticator app (Google Authenticator → Google Backup, or Authy)
- Save backup codes for every 2FA-enabled account in a password manager
- Register a secondary recovery method (backup phone number or email) on every service
- Store a written record of critical backup codes in a physically secure location
The Most Important Step: Backup Codes
Every major service provides backup codes when you enable 2FA. These are typically 8–12 single-use codes that allow you to sign in without your 2FA device. The single best way to prepare for losing your 2FA device is to save these codes immediately when you set up 2FA — not later, when it feels more urgent. Store them in a password manager or printed in a physically secure location. With backup codes, losing your 2FA device is a minor inconvenience rather than a crisis.
Platform-by-Platform Recovery
Recovery options vary significantly by platform. Google lets you sign in from a trusted device, use backup codes, or go through identity verification. Apple lets you use a trusted iPhone, Mac, or Apple Watch, or receive a code via trusted phone number. GitHub requires recovery codes or a registered fallback method — its recovery process is notably strict with no alternative if both are unavailable. Financial platforms like PayPal and Coinbase require identity verification through support. Most platforms will recover your account with enough patience, but the process takes time.
Registering a Backup Device
Many authenticator apps support multi-device sync. Authy, for example, allows you to add a tablet or second phone as a backup device that also shows your TOTP codes. Setting this up proactively means you have a second device generating valid codes if your primary phone is lost, stolen, or broken. For critical accounts, this is worth the small setup effort.
Storing Your TOTP Secret Keys
When you first set up an authenticator app for an account, the service displays a QR code (and usually a plain text key). This QR code encodes your TOTP secret — the cryptographic seed used to generate codes. If you save this secret key, you can restore access to that account's TOTP codes on a new device at any time by re-entering it. Some password managers (1Password, Bitwarden) can store both the password and the TOTP secret for an account, giving you everything in one place.
Prevention Is the Entire Strategy
The honest reality is that preventing the lockout scenario requires action before you lose your device, not after. The three-part strategy that works: save backup codes for every account when you set them up, use an authenticator app that backs up to the cloud (Authy or Google Authenticator with Google Account sync), and for the most critical accounts, register a second 2FA method when the service allows it. Do these things once, and losing your phone becomes a manageable inconvenience instead of an account crisis.
How Long Recovery Really Takes
With backup codes ready, account recovery takes a few minutes per account. Without them, the timeline varies sharply by platform: same-day for services with strong automated identity checks (Google and Apple, when you still have a trusted device or phone number), one to three days for services that require email confirmation, and several days to weeks for financial platforms that review requests manually — PayPal, Coinbase, and most banks fall into this last group. A twenty-account setup with no preparation can realistically turn into a week of back-and-forth with support teams.
The asymmetry is striking: preparing costs an hour; recovering costs days. Treat your authenticator app like a house key — you would not keep only one copy of a key for a house you care about, and the same logic applies to the accounts that control your money and identity. Save the second copy now, while it costs nothing.
What to Do in the First Hour After Losing Your Phone
The first hour decides whether this becomes a five-minute incident or a week-long recovery. Before you do anything else, attempt to locate the phone: use Find My iPhone or Android's Find My Device from a computer, and if the phone responds, put it in Lost Mode — it locks the screen, disables notifications, and buys you time while your 2FA codes still exist on the hardware.
Next, use another trusted device to change the password on your primary email account — the account that can reset everything else — and on any financial apps you use. Do this before you worry about social media. Then work through your accounts in priority order (below), starting with backup codes, which are the fastest path back in. Contact your mobile carrier about the phone's SIM or eSIM last, but do not skip it: a lost phone that is still active on your number is a liability, and suspending the number prevents someone else from using it against you.
Which Accounts to Recover First
Recovery is not a random walk through your inbox — order matters. Your email address is the master key: most password resets land there, and 2FA changes on other services are confirmed there. Recover email first, then your password manager (if you use one), then financial accounts, then everything else. A password manager is a special case: it holds the passwords you need to move through the rest of the list, so restoring it second is nearly as urgent as email itself.
Social media and shopping accounts are last, not because they are unimportant, but because they are the easiest to re-verify later and the least dangerous if they stay locked for a few days. Two-factor credentials live in an authenticator app or in SMS, and the order above guarantees you rebuild the foundation before decorating the house. Write the order down now, while you are calm, and keep it with your backup codes.
When You Have No Backup Codes at All
If you never saved backup codes, every platform becomes a support ticket, and the outcome depends on what you can still prove. Most services verify identity with combinations of: the recovery email on file, a trusted device that has logged in before, payment details, or answers about recent account activity. Prepare these before contacting support: the exact date you created the account, old passwords you remember, and any purchase receipts if the account has paid features.
Expect the process to be manual and slow — days, not hours, and longer for financial platforms. While you wait, keep records of every ticket number and reply, and respond to verification requests quickly; support desks close stale tickets aggressively. This is also the moment to learn the lesson for next time: the reason backup codes matter is precisely that this process is so painful.
Making Recovery a Household Habit
If the accounts you care about are shared — a joint bank account, a family email, a streaming subscription — recovery should be shared too. Password managers like 1Password and Bitwarden offer emergency access: a trusted person can request access, and the request is granted automatically after a waiting period you choose. That single feature turns "my spouse lost their phone" from a multi-day saga into a half-hour task.
For the truly critical items, a paper copy still beats every digital solution: print the backup codes for your two or three most important accounts and store them somewhere physically safe, like a lockbox or with your passport. Digital copies vanish with the phone; paper survives fires, breakage, and forgetfulness. One sheet of paper is all it takes to make the scenario this article describes a non-event.