New or lost phone: keeping access to 2FA accounts
Losing or replacing the phone that holds your two-factor authentication is the most common way people lock themselves out of their own accounts. The fix is preparation: backup codes kept offline, a second sign-in method on every important account, and an authenticator app whose codes you can move. Without them, recovery takes days at Google and Apple, and can be impossible at Microsoft.
How to keep access to your accounts when your phone changes
Prepare before it happens: save each account’s backup codes somewhere offline, add a second way to sign in, and use an authenticator app that syncs or exports your codes. When you replace a phone, move everything before you wipe the old one. If the phone is already gone, sign in with a backup code or another device, then remove the lost phone from your accounts. That is the practical side of our guide to two-step sign-in, and Google’s page on what to do when you lose your phone lists the same fallback options.
Recovery without any of these is slow by design. Providers make it hard on purpose, because the same process that lets you back in could let an attacker in.
Before anything happens: a 15-minute checklist
- Backup codes. Download or print the backup codes of your main accounts and keep them on paper or in a safe place that is not your phone. Google gives sets of 10 single-use codes; each new set cancels the previous one.
- A second method. Add another sign-in method to each important account: a passkey on another device, a security key, a second phone number, or a trusted computer.
- An app you can move. Use an authenticator app that syncs or exports codes; our comparison of authenticator apps shows which do.
- Recovery contacts. Google and Apple let you name a trusted person who can help you back into your account.
- The Microsoft recovery code. Microsoft accounts have a 25-digit recovery code; generate one, print it, and keep it away from the devices you sign in with.
Changing phones: move first, wipe last
Keep the old phone working until the new one is set up. Then, depending on the app:
- Google Authenticator: sign in to the same Google Account on the new phone and synced codes appear; otherwise, use the export option on the old phone, which produces a QR code to scan with the new one.
- Microsoft Authenticator: turn on backup on the old phone (iCloud on iPhone, a personal Microsoft account on Android), then restore on the new phone and sign in to each account again. A backup made on an iPhone cannot be restored on Android, or the reverse, and work or school accounts are not included.
- Authy: add the new phone as a second Authy device while the old one still works, as Twilio recommends; there is no export.
- Apps with an export file (2FAS, Aegis, Ente Auth, Proton, Bitwarden Authenticator): export, move the file securely, import, then delete the file.
Before wiping the old phone, sign in to two or three accounts with the new one to confirm the codes work.
If the phone is lost, stolen, or broken
The options and waiting times differ by provider, according to their help pages checked on November 10, 2026:
| Provider | Fallback options | If you have nothing else |
|---|---|---|
| Another signed-in phone, another number, a backup code, a security key, a passkey on another device, or a trusted device | Recovery can take three to five business days; a new sign-in method can take up to seven days to work | |
| Microsoft | Another verification method, or the 25-digit recovery code | Replacing all your security info means a 30-day wait; with two-step verification on and no alternate method, Microsoft says it cannot help |
| Apple | Another trusted device, a trusted phone number, or a recovery contact who gives you a code | Account recovery may take several days or longer; Apple Support cannot shorten it |
Two Apple options remove the safety net. A recovery key, a 28-character code, disables standard account recovery: lose it along with your devices and the account is locked permanently. The same risk applies to security keys if you lose all of them and all your trusted devices. Apple also advises against storing a recovery key in its Passwords app, Notes, or iCloud Drive.
When your authenticator codes were not backed up
If the lost phone held codes that were never synced or exported, there is no shortcut. As Google puts it for its own app, you have to visit every site, remove the old codes using a backup code or another method, and set up two-factor authentication again on the new phone. This is why the backup codes in the checklist matter more than the app you choose.
After you are back in
Remove the lost phone from the trusted devices of each account, generate new backup codes, and check the recovery email and phone number. If the phone was stolen rather than lost, change the password of your main email account as well.
Spare keys as a safety net
A registered security key kept in a drawer is one of the most reliable recovery options. Read who needs a hardware key and why two are better than one.
Passkeys and lost devices
Passkeys synced through your Google, Apple, or password manager account survive the loss of a phone, which makes them easier to recover than codes tied to one device. See how passkeys are stored and synced.