Lost Your Phone with the Authenticator? Do This Now

First: contain the risk

• Revoke sessions on key accounts (email, password manager, cloud). Many services let you sign out of all devices remotely.
• Change your password to a unique, manager-generated one. Need a strong passphrase you can remember? Learn how.
• Enable/confirm MFA on desktop where you’re still signed in.

Recover access (choose the fastest available)

• Use recovery codes if you stored them (password manager or safe location).
• Backup authenticator device (tablet/second phone) if you enrolled one.
• Security questions or support: contact the service and verify identity using trusted channels. Beware of phishing during recovery—run link checks: Verify Links Like a Pro.

Rebuild a safer MFA setup

• Enroll two factors: two authenticators (phone + tablet) or a pair of security keys kept separately.
• Save recovery codes in a password manager and keep an offline copy in a secure place.
• Add device screen lock and biometric/boot protection; enable remote wipe where available.

If any account looks compromised

• Follow a lightweight incident plan: The Simple Incident Playbook for Leaked Passwords (revoke sessions, rotate, audit, notify).
• For email, check forwarding rules and filters added recently.

Sharing new MFA or recovery codes safely

• One-time, expiring delivery with a separate access code. Basics: The Safe Way to Share Passwords in 2025 (No Email).
• Zero-knowledge delivery keeps providers from reading your content. Primer: Zero-Knowledge Sharing.

FAQ

Should I switch numbers or SIMs?
If your phone or SIM was stolen, contact your carrier to lock/replace the SIM and consider number change if targeted.

Is SMS 2FA enough for now?
Use it as a temporary bridge if needed. Move to an authenticator app or security keys as soon as possible.

Related reading

Phishing-safe recovery habits: Verify Links Like a Pro

Strengthen your master passwords: Create Strong Passphrases

Delivery without inbox trails: The Safe Way to Share Passwords in 2025 (No Email)

Bottom line

Act fast to revoke access, recover cleanly, and rebuild with redundancy. Two enrolled authenticators (or security keys) + stored recovery codes = fewer future emergencies.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.