If your phone with Google Authenticator, Microsoft Authenticator or Authy was lost, broken or reset, you can usually get back in. Fixing a lost phone authenticator app lockout comes down to three steps: check whether your codes were synced or backed up, use backup codes or another sign-in method, and only then use each service’s official recovery process.
First, Check Whether Your Codes Were Backed Up
Install the same authenticator on your new phone and see what it can restore before contacting any service.
- Google Authenticator: If you signed in to the app with your Google Account, your codes are synced. Sign in with the same account on the new phone and they should appear. If you used the app without signing in, the codes lived only on the old phone.
- Microsoft Authenticator: If Cloud Backup (Android) or iCloud backup (iPhone) was on, tap Restore from backup (older versions show Begin recovery) before adding any account, then sign in with the personal Microsoft account used for the backup. Backups restore only to the same platform. Third-party codes come back ready to use, while work or school accounts restore only the account name and need a fresh sign-in.
- Authy: Tokens survive only if Backups were on and you know your backups password, which Twilio cannot reset. Without another Authy device that allows multi-device, account recovery takes 24 hours, and opening your Authy account during that window cancels the request. The Authy desktop apps reached end of life on March 19, 2024, so an old desktop install is no longer a fallback.
Use Backup Codes and Other Sign-In Methods
For any account that did not come back, work through these options in order.
- Find your backup codes. Google issues sets of ten single-use codes, and a downloaded set is usually named Backup-codes-username.txt. Facebook offers one-time recovery codes and Microsoft offers an account recovery code. See our guide to two-factor authentication backup codes.
- Use a device that is still signed in. A logged-in tablet or laptop may let you approve the new sign-in.
- Pick another method. On the code screen, look for Try another way and choose a backup phone number, a security key or a passkey.
- Get your number back. Ask your carrier for a replacement SIM, then protect the number against SIM swap attacks.
- Secure the lost phone. Erase it remotely if you can, remove it from your Google or Microsoft device list, and change key passwords.
How Major Services Handle a Lost Authenticator
When the quick options fail, each platform has its own recovery path. This summary reflects their official help pages; screens and wait times can change.
| Service | Try first | If that fails | Typical wait |
|---|---|---|---|
| Google Account | Prompt on another signed-in device, backup code, security key or passkey | accounts.google.com/signin/recovery from a familiar device and location | 3 to 5 business days when no other second step exists |
| Microsoft account | Another verification method or recovery code | Replace your security info, or use the account recovery form | 30 days for replacement; form answered within 24 hours |
| Work or school account | Other registered methods | IT admin or help desk resets your methods | Depends on the organization |
| Approve from a logged-in device or use a recovery code | Identity confirmation via Need another way to authenticate? | Typically 1 to 2 business days | |
| Backup code or a trusted device | Login help in the app, which may ask you to confirm your identity | Varies | |
| Amazon | Backup method or trusted device | Didn’t Receive the Code, then Two-Step Verification Account Recovery | Not stated |
| Coinbase | Another 2-step method | Account recovery with ID upload or trusted contacts | Up to 24 hours, plus a possible 24-hour hold on sending funds |
Recovery forms are mostly automated, so use a device and network you have signed in from before, answer every question, and give the most recent password you remember. Submit one request per account and let it run: Microsoft says it cannot speed up the 30-day period unless the request is canceled. Never share codes with anyone claiming to be support. For specific cases, see recovering Gmail without a phone or recovery email and our crypto exchange recovery guide. If the account runs a business page or ad account, ask a second admin to keep things moving meanwhile.
How to Move Your Authenticator to a New Phone Properly
If you still have the old phone, keep it working until every code is confirmed on the new one.
- Google Authenticator: Sign in to sync, or on the old phone tap Menu, Transfer codes, Export codes, select accounts and tap Next. On the new phone tap Menu, Transfer codes, Import codes and scan the QR code.
- Microsoft Authenticator: Turn on Cloud Backup in Settings on Android; on iPhone, iCloud Drive, Keychain and Backup must be on. Restore on the same platform, then sign in again to work accounts.
- Authy: Tap the gear icon, go to Devices, turn on Allow multi-device and confirm your backups password before installing on the new phone. Authy has no export feature, so switching apps means re-adding each account.
- Test before you wipe. Sign in to each important account with the new phone, then remove the old one from your device lists.
How to Set Up So This Never Happens Again
- Two methods per account: pair the authenticator with a security key, passkey or backup number.
- Offline backup codes: print them and store them safely at home.
- Sync turned on: Google Account sync, Microsoft backup or Authy Backups with a stored password.
- Passkeys: synced passkeys survive a phone swap; our password manager comparison covers tools that store them.
- Current recovery info: Microsoft recommends three pieces of security info per account.
When to Get Professional Help
If backup codes, other devices and the official recovery flow have not worked, or the account controls business assets or funds, a structured approach can help. AccRevert reviews the case, organizes the ownership evidence and prepares a documented request or appeal that is submitted through the platform’s official channels. We work only through those channels, and no outcome can be promised.
A flat $299 case-preparation fee opens a case; a success fee of $599 for personal accounts, $999 for business accounts or $1,199 for Business Manager and ad accounts applies only if access is restored. Payment is by PayPal only. See our 2FA and authenticator lockout recovery page.
Frequently Asked Questions
Can I recover Google Authenticator codes without the old phone?
Only if they were synced to your Google Account. Otherwise you need backup codes or each service’s recovery process.
Will a new phone with the same number restore my authenticator?
Not by itself. Google and Microsoft authenticator codes come from secrets stored in the app or its backup, not from your number. Authy is tied to your number, but tokens return only if Backups were on and you know the backups password.
Why don’t my work accounts work after restoring Microsoft Authenticator?
Work and school accounts restore only the account name, so you must sign in again. If the old phone was your only method, your IT admin needs to reset it.
How long does authenticator account recovery take?
It depends on the service: 24 hours for Authy, up to 24 hours for Coinbase ID review, possibly 3 to 5 business days for Google and 30 days for a Microsoft security info replacement.
Final Checklist
- Try sync or restore in the authenticator on your new phone.
- Look for printed or downloaded backup codes.
- Try signed-in devices, backup numbers, keys and passkeys.
- File one official recovery request per account and wait.
- Once back in, add a second method and save new codes offline.
Still locked out of your authenticator accounts? Open your recovery case with AccRevert: a flat $299 case-preparation fee starts the work, and the success fee ($599 personal, $999 business, $1,199 Business Manager or ad account) applies only if access is restored.
Related Articles
Stop guessing and document the case properly.
Our team can review the account history, available ownership evidence and the recovery steps already attempted.
“Someone May Have Accessed Your Account” on Facebook: What to Do
Copyright Violation Scam on Instagram and Facebook: How to Spot It
