If your sign-in code or approval normally comes through a phone you cannot use, start with the account provider’s official recovery instructions. Check whether you already have a permitted alternative. Do not guess codes, approve unfamiliar prompts, or disable protection to force your way in.

If the phone may be stolen, the account may be compromised, or access affects urgent care or payments, contact the relevant provider, carrier, financial institution, or managed-device administrator promptly. This guide is not an order that delays reporting or necessary help. Do not confront a suspected thief.

If you are preparing before a loss, choose one account you are authorized to manage and note its official recovery route privately. Unknown details can stay blank. You do not need a new security key, a helper, or a complete household account inventory to start. Multifactor authentication (MFA) adds a sign-in check beyond a password; the permitted method and recovery process depend on the service.

An open black compartmented box holding a plain card, a metal key and a USB stick on a wooden entry cabinet beside books, a lamp and a plant.
An alternative sign-in method only helps if the provider accepts it for your account.

First decide whether the phone is unavailable or untrusted

These are different incidents:

  • Unavailable but controlled: the phone is at home, out of charge, offline, damaged, or temporarily inaccessible.
  • Lost: the location is unknown, but theft is not confirmed.
  • Stolen or possibly accessed: another person may possess the device, SIM, notifications, or active sessions.
  • Compromised: the device or account shows unexpected prompts, sessions, forwarding, settings, messages, or transactions.
  • Managed: an employer or school owns the device or controls the account.

For a simple battery or connectivity problem, an already registered alternative may help, but the service still needs its required connectivity. For theft or compromise, treat the device and its sessions as potentially exposed and involve the carrier, provider, organization, or financial institution promptly. Do not connect a potentially compromised device to another device as a recovery experiment.

Check the alternatives your provider actually offers

The provider decides what is accepted; this is not a universal sequence. Possible options include:

  1. a passkey or authenticator on another already registered trusted device;
  2. a separate registered security key;
  3. a provider-issued backup code;
  4. a second verified phone number or provider-supported voice method;
  5. a recovery contact or family recovery feature;
  6. an organizational administrator for work or school;
  7. the provider’s formal identity and account-recovery process.

Start through the known app or manually entered official address, not a link sent after the loss. A search result, sponsored advertisement, social-media account, or incoming caller may impersonate support. A spare device, code, or helper is not automatically a recovery method unless the provider accepts it for the exact account.

Do not repeatedly guess codes or passwords. Repeated attempts can trigger additional controls, obscure the real problem, or increase urgency. Read the message, record the provider’s stated next step, and use the documented fallback.

If the phone may be stolen

Use a known-clean device and verified channels. Urgent safety, care, financial reporting, and organizational support come first; do not complete every item before seeking help:

  1. Check personal safety; do not confront a suspected thief.
  2. Use the platform’s official lost-device feature if it was enabled and appropriate.
  3. Contact the carrier to report possible device or SIM loss and ask about the account’s official protection process.
  4. Use the provider’s legitimate recovery route for affected accounts, including email or a password manager that resets other accounts.
  5. Review recent sessions, recovery methods, forwarding, and alerts.
  6. Follow the current provider’s instructions for revocation, after considering effects on legitimate access, tracking, recovery, and any employer, insurer, or law-enforcement instructions.
  7. After legitimate access is restored, follow the provider’s security process for affected methods and codes; do not remove your only usable factor as a drill.
  8. Check financial, payment, cloud, communication, work, health, and social accounts for unauthorized activity.
  9. Keep necessary times, provider cases, and suspicious-transaction evidence in protected records, not a site form or broadly shared note.

Remote lock, location, and erase actions may require the device to reconnect. Erasure can affect later tracking, evidence, or recovery. Follow the current official platform instructions rather than assuming one action fits every incident.

If a blackout is the only problem

An authenticator app may generate codes without cellular service, but the login service and device still need whatever connectivity and time synchronization their design requires. A text message may be delayed when networks are congested. A push request requires connectivity. A physical security key may work locally with a compatible powered device, but it does not guarantee that the account service is reachable.

Before an outage, check one account’s actual needs. Depending on the service and your situation, useful preparation may include:

  • keeping the primary device charged safely;
  • storing compatible charging cables and a modest power bank;
  • registering an independent factor where supported;
  • printing or securely storing provider backup codes;
  • keeping essential provider and organization contacts on paper;
  • downloading necessary non-secret information for offline use;
  • deciding which tasks can wait until service returns.

These are options, not a shopping list or instructions to change all accounts tonight. Read the provider’s instructions before adding or replacing a factor. Do not exhaust limited power repeatedly refreshing an unavailable service. Do not delay urgent care, necessary communication, or financial reporting while waiting for a login. Use the power outage communication plan and the power outage hub for household priorities.

Prepare backup codes correctly

Backup codes are high-value credentials. Provider behavior varies. Google’s current guidance says a used code becomes inactive and a new set invalidates the old set; backup-code download is unavailable under its Advanced Protection Program. Those are Google-specific rules, not promises about every service.

For the provider you are checking:

  • follow its official instructions for creating or finding codes during authorized access;
  • confirm what invalidates or replaces them;
  • store them away from the protected device;
  • do not photograph them into the same cloud account they recover;
  • do not label an exposed copy with more identifying information than needed;
  • limit access and keep a second controlled path only when justified;
  • follow its replacement process after use, suspected exposure, or a security reset;
  • understand what becomes invalid before replacing or disposing of necessary recovery material.

Do not generate a new set merely to rehearse recovery or tidy a folder. Preserve your only usable path until you have followed the provider’s actual replacement process. Keep code values, passwords, keys, full or partial account identifiers, and exact secret locations out of site forms, email, or broadly shared notes.

Never type a backup code into a form reached through an unsolicited message. A provider may ask for one during its own login flow, but support should not need you to read the code to a caller.

Use more than one device only with control

An extra registered method can help in some situations, but it also adds an access path. Before changing anything, a private note about one existing method can identify a question to ask the provider:

Questions about an existing recovery method
MethodWhat to check privately
Phone app or passkeyDoes recovery still depend on this phone, and what does the exact provider accept?
Another device or keyIs it already registered, permitted, powered and compatible?
Backup codesAre they supported and current? Keep values separately protected.
Contact or administratorWhat is this person’s permitted role, and what verification applies?

You can work alone through the provider’s recovery process; a helper is optional. Apple’s recovery contact, where configured and supported, can supply a recovery code but does not gain account access by being a contact. The feature’s requirements and limits are Apple-specific. A household relationship does not itself grant legal or organizational authority. The offline credentials guide separates general clues from protected recovery material.

Avoid five dangerous shortcuts

  • Turning MFA off permanently because one recovery was difficult.
  • Adding a shared phone number without considering takeover, privacy, or household changes.
  • Approving repeated push requests to make notifications stop.
  • Sending codes or keys to someone who claims they found the phone.
  • Installing a remote-support tool at the direction of an incoming call or message.

After recovery, change any password that may have been exposed, sign out unknown sessions, verify recovery details, review account activity, and strengthen the factor setup. FTC guidance recommends those controls after regaining a hacked account.

Review one uncertain method while access works

Choose one account during normal authorized access. Without signing out, disabling protection, interrupting assistive technology, or removing your only working factor:

  1. note the chosen provider and an existing factor type privately;
  2. confirm backup-code storage without exposing the codes;
  3. verify recovery phone, email, and trusted contacts;
  4. check that alternate hardware is present, compatible, and not damaged;
  5. ask the provider or administrator about unfamiliar or obsolete methods before changing them;
  6. update the response card for a lost phone;
  7. record the review date and owner.

Unknowns can stay blank. No quarterly appointment, group meeting, purchase, or full inventory is required. Stop after one useful question if that is enough for today. Never remove a factor, rotate codes, erase a device, or disable necessary communication to see whether recovery works. Make an optional reminder after a relevant change if it helps.

Use the password recovery planning checklist for account dependencies and the digital continuity hub for backup, power, and data recovery.

Sources reviewed

  • Federal Trade Commission: Use Two-Factor Authentication; How to Protect Your Phone From Hackers; How to Recover a Hacked Email or Social Media Account
  • NIST: How Do I Create a Good Password?
  • Google Account Help: Sign In With Backup Codes
  • Apple Support: Set Up an Account Recovery Contact

Historical source review: July 14, 2026. The named FTC/NIST principles and Google’s backup-code and Apple’s recovery-contact pages were checked October 3; only those specific provider examples were verified, not every service’s features. Provider rules change. Follow the current official instructions for the exact account, factor, device, and organization.