Generator/Troubleshooting/lost-phone
The phone with your authenticator is gone.
Your accounts are not lost, but the order you work in decides how many of them you keep. Start with what still holds a live session, not with support tickets.
Urgency Hours, not daysFirst move Find a live sessionWorst case Identity reviewUpdated 2026-09-17
Work in this order
- Any device still signed in. A laptop with a live session can re-enroll a new authenticator without any recovery step at all. This is the cheapest path and it expires, so use it first.
- Recovery codes. The list you were shown at enrolment. One code, one login, then re-enroll immediately.
- Secrets in a password manager. If you saved the Base32 keys, paste them into any authenticator and you are done.
- Account recovery. Identity documents, selfies, waiting periods. Days at best, and some accounts never come back.
Do this before anything elseList every account that used that phone. Email first, because it is the reset path for everything else, then anything holding money.
Email comes first
Whoever controls your inbox controls the password reset for most other accounts. If the mailbox is locked behind the missing authenticator, nothing else can be recovered until it is back. Start there even if a trading account feels more urgent.
Once you are back in
- Save the text key, not just the QR. Keep the Base32 secret in a password manager so a lost device is an inconvenience rather than an incident.
- Enroll a second factor on a second device. TOTP has no registration step: the same secret can live in two places on purpose.
- Store recovery codes off the device. Printed, or in a different vault from the one they protect.
- Check the account contact details. Stale recovery email and phone numbers are what turn a lockout into a permanent loss.
Questions
- Can I move Google Authenticator to a new phone without the old one?
- Only if you turned on account sync beforehand, or exported the accounts while the old phone still worked. The classic offline version stores secrets locally with no server copy; without a backup there is nothing to transfer.
- Is it safe to keep the same secret on two devices?
- Yes, and it is the standard way to stay recoverable. TOTP does not track devices; anything holding the secret produces the same code. The risk is where the copies are stored, not that copies exist.
- Should I just switch everything to SMS instead?
- No. SMS is recoverable precisely because it is weak — a SIM swap defeats it, which is the common attack on exchange and email accounts. Keep TOTP and fix the backup problem instead.
Related