Two-Factor Authentication FAQs: Sharing Codes, New Phones and Trusted Devices
Can you share a 2FA code? How do you move Google Authenticator to a new phone, and what does "trusted device" really mean? Official Google, Microsoft and Apple answers on sharing codes, QR-code transfers, trusted devices and changing your trusted phone number.
Never share a code, move your authenticator before you wipe the old phone, and trust only devices you own — three answers clear up most two-factor confusion.
Key points
- Codes are for you alone at sign-in: Google never asks for a backup code other than at sign-in, and Microsoft says its support agents cannot send reset links or change account details for you.
- A new phone is painless if you prepare: Google Authenticator codes sync when you sign in on the new device, or transfer manually with a QR code from the old phone.
- A trusted device is one you have already signed in on with two-factor authentication; Apple and Microsoft both use that trust to skip routine codes, so remove any device you no longer own.
Two-factor authentication sounds simple until real life asks awkward questions. Someone asks you to read out a code “just this once”. A new phone arrives and the old one is already wiped. A laptop you sold still counts as trusted. Each moment is exactly where accounts are quietly lost — or stolen.
This final guide in our series answers the questions readers ask most, using only what Google, Microsoft and Apple say on their own help pages. For the foundations, start with two-factor authentication explained.
Can I ever share a verification code or a backup code with someone else?
No — a code is the second half of your login, and legitimate companies ask for it only on their own sign-in screen.
Short answer: no. Google is explicit — do not share backup codes with anyone, and Google never asks for one other than at sign-in. The same logic covers verification codes, because a code typed in by someone else, on their device, signs them in as you. The asker might sound like a bank or a hurried colleague, but urgency is how this trick is meant to feel.
Microsoft adds a reality check: its support agents are not allowed to send password reset links, or access and change account details. Anyone claiming to be support and asking for a code “so they can fix it” contradicts how the real system works. Hang up, and sign in yourself through the official site or app. Helping a partner at home, phone in their hand, is their sign-in on their device. Reading a code out or texting it is sharing — and once it leaves your hands, you cannot control where it goes.
How do I move my authenticator app to a new phone without locking myself out?
Sign in on the new device for synced codes, or use the old phone to create a transfer QR code — before you wipe anything.
The order is everything. Google explains that Google Authenticator can synchronise your codes across devices simply by signing in to your Google Account: sign in within the app on a new device, and your codes sync to it automatically. You need version 6.0 or above on Android or 4.0 or above on iOS, and codes are encrypted in transit and at rest.
Without a Google Account, you can still transfer manually — but you need the old device, with the latest app version installed, plus the new device. Install Authenticator on the new device, tap “Get Started”, sign in, create a QR code on the old device, then tap “Scan QR code” on the new one. After scanning, you get confirmation the codes have transferred. Factory-reset the old phone first, and that route disappears with it.
Our advice is boring and reliable: set up the new phone, check every important account’s codes work, and only then wipe the old handset. Our comparison of authenticator apps — Google, Microsoft and Authy may help you choose, and our guide to SMS codes vs authenticator apps vs security keys covers non-phone fallbacks.
What exactly is a trusted device, and should I tick “don’t ask again”?
Trusting a device skips routine codes — convenient at home, risky anywhere shared.
Apple defines it cleanly: a trusted device is an iPhone, iPad, Apple Watch, Apple Vision Pro or Mac on which you have already signed in using two-factor authentication. Because Apple knows it is yours, it can display codes when you sign in elsewhere, and be used for critical changes such as changing your password. The code is displayed automatically on your trusted devices; choose “Allow”, read the six-digit code, and enter it on the other device.
Google describes the same idea: if you checked “Don’t ask again on this computer”, you might sign in there without a second step. Microsoft mirrors it — you get a code every time you sign in on a device that is not trusted. Tick the box on your own laptop at home; never on a shared or public computer. Apple adds: protect trusted devices with a passcode, or a login password on a Mac, and Face ID, Touch ID or Optic ID where supported.
What happens when I replace a trusted phone number or get rid of an old device?
Add the new number first, confirm it works, then remove the old one.
Numbers change, and devices get sold or handed down. Apple warns why this deserves care: you need at least one trusted phone number on file, and if your iPhone is your only trusted device and the only device with access to that number, you cannot receive the codes needed if it is missing or damaged. Add another trusted number before you need it — on iPhone or iPad via Settings, your name, Sign-In & Security, then Two-Factor Authentication; on a Mac through System Settings; or on the web at account.apple.com.
Apple also notes that if you temporarily lose access, the fastest route back is often to wait until you have access again in the next few days. Permanent loss starts formal recovery. Never remove the old route until the new one has received a code.
What this means
Most two-factor disasters are not hacks — they are small, kind, hurried decisions made in ordinary moments.
Look back at the questions in this guide and a pattern emerges. Nobody wakes up planning to hand a stranger the keys to their email. Instead, someone tired gets a plausible phone call at teatime. Someone excited about a new phone wipes the old one in the shop. Someone clicks “trust this device” on a computer that was never really theirs. Each decision takes five seconds, feels harmless, and only reveals its price later, when codes are going to the wrong place — or to no place at all. That is not carelessness, exactly. It is a system that asks for perfect attention at the exact moments when life is distracting you.
In our view, the healthiest way to think about codes is as spoken passwords. You would not read your password aloud to a caller, text it to a group chat, or leave it saved on a shared computer — and a verification code deserves exactly the same instincts, because in that moment it does the same job. Likewise, a trusted device is best understood as a spare key cut for your home. Wonderful to have, sensible to keep track of, and absolutely something you reclaim when you move house or change the locks. Old phones in drawers, laptops passed to cousins, numbers recycled to strangers: each one is a key you forgot you issued.
The hopeful part is how small the counter-habits are. Move the authenticator before wiping, not after. Add the new number before removing the old one. Pause for ten seconds whenever anyone, however friendly, asks for a code — genuine companies have built their processes so they never need to ask. These are not technical skills. They are the same common sense you already use with house keys and bank cards, applied to a newer kind of lock. If this series leaves you with one feeling, we hope it is not anxiety but ownership: your accounts, your devices, your rules — set calmly, in advance, while nothing is going wrong, and checked again whenever a phone, number or laptop changes hands.
Bottom line
Never share codes, transfer before you wipe, and trust only devices you still own.
Three habits answer almost every question here: never share codes, move the authenticator before erasing the old phone, and trust only devices and numbers you control today. Remove anything stale, and add a backup route. For set-up help, see how to turn on two-factor authentication.
Related Guides
More from this pillar.
- Two-Factor Authentication Explained
- How to Turn On Two-Factor Authentication
- Authenticator Apps Compared: Google, Microsoft and Authy
Sources
Official help pages used.
