Your password works. The six-digit code is on a phone you don't have.

Try every other door first

• Backup codes. Every major service handed you eight or ten one-time codes the day you switched 2FA on. If you printed them or saved them anywhere a browser can reach, this is over in a minute. Check old email, your downloads folder on another machine, the drawer at home someone can look in.
• A device that's still signed in. A laptop, a tablet, a browser session at home - an already-authenticated session usually won't be asked for the code, and from inside the account you can mint new backup codes and enrol a new factor.
• The authenticator may have synced. Google Authenticator can back its codes to your Google account; Authy restores to a new device with your number and its backup password; iCloud Keychain carries verification codes to any Apple device you own. Install the app on a borrowed or new device and check before assuming the codes died with the phone.
• “Try another way.” The small link under the code prompt. Services often hold a second path they don't advertise - a secondary email, a passkey on another device, a prompt to an old phone still associated with the account.
• SMS codes: rescue the number, not the phone. If your second factor is texts, the number is the key and the number is portable. The physical SIM works in any cheap handset; an eSIM can be reissued by your carrier, usually with ID. Once the number rings again, the codes flow again.

If every door is shut: account recovery

Now it's the slow lane - deliberately slow, because the same form is how an attacker would get in. Expect identity questions and a waiting period measured in days, not minutes.

• Start from a machine and place the service knows. Your home network, your usual laptop, your usual country. Recovery systems score familiarity; a request from a hotel lobby abroad looks exactly like the attack they're built to stop.
• Answer with old truths. Account creation date, previous passwords, addresses you've emailed - approximate answers to many questions beat perfect answers to two.
• Some accounts have no back door at all. Game accounts, crypto exchanges, and some privacy-first email providers treat a lost second factor as final unless you hold their recovery code. For those, what you saved in advance isn't a convenience - it's the only key that exists.

What each service does when your second factor is gone

Same question, twenty-two answers. Whether a service handed you backup codes, what path stays open once the phone is gone, and how long it takes. The rows marked Hard wall have no back door at all - lose the codes and the account is gone, which is exactly why they're worth saving in advance.

Last verified: 2026-07-21

So this never happens again

Every escape route above was built beforethe phone went missing: a printed code, a second factor, a synced authenticator, a session left signed in. The fix takes one evening - download backup codes for the accounts that matter, register a second factor where you can, and put the codes somewhere that isn't the phone.

Paper in a drawer works until you're a continent away from the drawer. The other place worth having is a page any borrowed browser can open - encrypted, unlocked with your name and a PIN, holding your backup codes, key numbers, and the plan. Set it up once, and the next time a login screen asks for a code from a phone that's gone, it's a detour instead of a disaster.