Lost Your Phone? How Backup Codes and Recovery Methods Save Your Accounts

Losing your phone does not have to mean losing your accounts — a saved backup code, second number, security key or passkey still gets you back in.

It is a horrible, sinking moment. You pat your pockets, check your bag twice, and the phone is not there. Then the second wave hits: that phone proved you were you — it received your codes, showed your prompts and held your authenticator app. Without it, even the correct password may not open your own email.

Take a breath. Usually you are locked out of a device, not out of your life — which one depends on whether you set up a second way in beforehand. This guide walks through what still works. For the foundations, start with two-factor authentication explained.

Your phone is gone, but Google gives you five other ways to prove it is you

Another signed-in phone, another number, a backup code, a security key or a passkey can stand in for it.

Google’s help page is reassuringly practical. If you have lost access to your primary phone, you can verify it is you with another phone signed in to your Google Account, another phone number added in the 2-Step Verification section, a backup code you previously saved, a hardware security key added to your account, or a passkey created on another device. On the sign-in screen, choose “Try another way” and pick whichever you still have.

Two quiet lifelines help too. If you once ticked “Don’t ask again on this computer”, you may sign in from that trusted device without a second step. And your carrier can transfer your number to a new phone or SIM.

Once back in, Google recommends: sign out of the lost phone, and change your password.

A saved backup code is the spare key that works when nothing else does

Google codes are 8 digits, arrive in a set of 10, and each one dies the moment you use it.

Backup codes sound old-fashioned until the day they save you. Google says you can use one for the second step when you cannot sign in normally — because you lost your phone, changed your number, or cannot get codes by text, call or Google Authenticator. Sign in, click “Try another way”, choose “Enter one of your 8-digit backup codes”, and type an unused code. Each code works once, then becomes inactive.

You can get a new set of 10 whenever you want; a new set automatically makes the old set inactive. Google suggests storing a printed copy somewhere safe, like where you keep your passport. Downloaded codes? Search your computer for a file named in the pattern “Backup-codes-username.txt”. If the codes are lost, Google’s fix is: 2-Step Verification section, “Show codes”, then “Get new codes” to revoke them. Never share them — Google never asks for one other than at sign-in.

Microsoft and Apple use different spare keys, so know which one you saved

Microsoft’s code has 25 digits, Apple’s key 28 characters — and both replace themselves when renewed.

Microsoft’s version is a 25-digit recovery code, for regaining access if you forget your password or your account is compromised. Generate it from the “Manage how I sign in” page, under Recovery code, by selecting “Generate a new code”. A new code stops any previous one working, and you cannot retrieve or download an existing code later. Print it, keep it safe, and do not store it on a sign-in device.

Apple’s optional recovery key is a 28-character code used, along with a trusted phone number and an Apple device, to regain access. Setting one up turns off standard account recovery, so you must use the key and your trusted number to reset your password. Apple advises printing a copy and keeping it safe — possibly with a trusted family member — and warns: if you cannot provide the key when you lose access, you will be locked out permanently, because Apple cannot provide it for you. For everyday sign-ins, a code can still be displayed on a trusted device, or sent to your trusted number. Our guide to SMS codes vs authenticator apps vs security keys compares the everyday options.

If no backup works, recovery is possible — but it runs on the provider’s clock, not yours

Google talks about days, Microsoft about 30 days, and Apple about a few days or longer.

Suppose no spare key exists: no printed codes, a dead old number, no second device. You are now in formal account recovery, and it is deliberately slow. Google explains why: because 2-Step Verification requires an extra step to prove you own the account, it can take 3–5 business days to make sure it is you. You will be asked questions to confirm the account is yours, and may be asked for a contact email or phone number, and for a code sent there.

Microsoft is sterner: with two-step verification on you always need two forms of identification, so a password alone will not get you back in — and it can take 30 days to regain access. It strongly recommends three pieces of security info, just in case. Apple says recovery might take a few days or longer, and contacting Apple cannot speed it up. Slow is the point: a process a stranger could rush would not be protection. Use only official routes.

What this means

A lost phone tests the preparation you did months ago, not the cleverness you can summon today.

Here is the uncomfortable truth nobody enjoys hearing while staring at an empty pocket: the moment you lose your phone is the worst possible moment to discover how your accounts are set up. Everything here splits into two groups — the things you arranged calmly, months earlier, over a cup of tea, and the slow, anxious waiting that replaces them if you did not. A printed sheet of codes in a drawer feels embarrassingly low-tech next to passkeys and security keys. Yet on the worst day, that sheet is pure gold. It needs no signal, no battery and no missing handset. It just works, once — and once is enough to get you home.

In our view, the real lesson is not “buy a security key”, useful as that can be. It is redundancy. One phone holding your password manager, authenticator, texts and email is a single point of failure wearing a nice case. Two or three independent ways in — a second number, codes on paper, a passkey on a laptop — turn a disaster into an annoying afternoon. Think of the everyday version: your phone dies at the airport, your travel details sit in your email, and a spare sign-in route is the difference between a story you laugh about later and a missed flight.

There is a kindness point here, too. Lockouts feel shameful, as if you failed a basic test of modern life. You did not. These systems are genuinely confusing, the names differ between companies, and almost everyone sets them up in a hurry. If you are locked out now, work through the options in order and let the recovery clock run if it must. If you are comfortably signed in, you have been given the easiest win in digital security: ten minutes today, saving codes and adding a second method while it is boring. Future you, standing in the rain without a phone, will be grateful. For the set-up steps, see how to turn on two-factor authentication. That small, calm effort, done once and checked occasionally, is what stands between a lost phone and a lost account.

Bottom line

Keep at least two independent ways back in, on paper or on a second device, before you ever need them.

Losing your phone is survivable if a backup code, second number, security key or passkey waits somewhere the phone is not. Save Google’s codes, print Microsoft’s recovery code, think carefully before enabling Apple’s recovery key, and revoke anything the lost phone could expose.

Related Guides

More guides.

• Two-Factor Authentication Explained
• How to Turn On Two-Factor Authentication
• Authenticator Apps Compared: Google, Microsoft and Authy

Sources

Official help pages used.

• Google Account Help — Fix common issues with 2-Step Verification
• Google Account Help — Sign in with backup codes
• Microsoft Support — How to get a Microsoft account recovery code
• Apple Support — Set up a recovery key for your Apple Account