Two-Factor Backup Codes: How Not to Get Locked Out of Your Email, Cloud and Work Systems After Losing Your Phone, Why SMS Isn't the Best Second Factor and How to Store Fallback Sign-in Methods Properly

Two-factor authentication, or 2FA, means signing in needs not just a password but a second confirmation: a code by SMS, a code from an app on your phone, a tap in an app or a physical key. Even if your password is stolen, an attacker can't get in without the second factor. That's why security specialists advise turning on 2FA wherever possible — and it's good advice. But this protection has a flip side that people remember too late: if the second factor lives only on one phone, and that phone is lost, smashed or stolen, you risk locking yourself out of your email, your photo cloud, work systems and crypto wallets. Let's look at how to avoid that.

Types of second factor

• SMS codes. The most common and most convenient, but the least reliable option. Attackers can intercept texts through SIM swapping, where a fraudster persuades the operator to reissue your SIM in their name. And without access to your number — abroad without roaming, for example — you can't sign in.
• Authenticator apps. These generate six-digit codes that change every 30 seconds. More reliable than SMS, but the codes are stored on a specific phone. Some apps can sync codes via the cloud; others can't.
• Push approvals. The service sends an "Is this you signing in?" prompt to an app on your phone. Convenient, but it's dangerous to tap "Yes" without thinking on prompts you didn't trigger.
• Hardware keys and passkeys. A physical USB or NFC key, or a passkey tied to a device. The most phishing-resistant option, especially for important accounts.

Backup codes — your spare key

When you turn on 2FA, most services give you a set of one-time backup codes. Each lets you sign in once without the second factor. Many people skip this step or save the codes in a file on the same phone. The right approach is to print them or write them down and keep them somewhere safe at home, and also in a password manager with its own protection. If the codes are used up or lost, generate new ones.

Several sign-in methods for important accounts

For email, cloud storage and work systems, set up more than one second factor: for example, an authenticator app plus a hardware key, plus backup codes, plus an up-to-date backup phone number and recovery email. Then losing one device doesn't become a disaster. It's especially important to protect your main email: it's how you regain access to almost every other service.

Changing phones

The most common mistake is resetting the old phone before the authenticator codes have been moved to the new one. Many apps need a separate transfer: exporting accounts, scanning QR codes on the new device or re-linking on each site. The right order is: install the authenticator on the new phone, move or re-link every account, check you can sign in to each — and only then reset the old device.

If the phone is already lost

If you have backup codes, use them to sign in and link a new device. If you don't, you'll have to go through each service's account recovery procedure: via a recovery email, a backup number, security questions or identity verification. It can take days or weeks, and for some services recovery without fallback methods is impossible altogether. For crypto wallets, losing access usually means losing the funds. If you suspect your phone was stolen, block the SIM with your operator immediately and change the passwords for important accounts from another device.

Checklist

• Turn on 2FA for email, cloud, banking, social media and work systems.
• Where possible, choose an authenticator or key instead of SMS.
• Print your backup codes and keep them separate from the phone.
• Add a fallback sign-in method for the most important accounts.
• Keep your backup number and email up to date.
• Before resetting an old phone, check that every code has been moved.

What our technician does

1. Lists your important accounts and checks how they're protected.
2. Turns on two-factor authentication with a suitable method and sets up fallbacks.
3. Helps save backup codes and arrange safe storage for them.
4. Moves the authenticator and links to a new phone without losing access.
5. If a phone is lost, helps you through the access recovery procedures.

A real example

A freelance designer from Saburtalo worked with foreign clients through a work email account, cloud storage and a payment platform, all protected by codes from an authenticator app. After buying a new phone, he reset the old one without moving the codes and found himself locked out of all three services. He had no backup codes. We helped him regain email access via a backup number, and get through identity verification for the cloud and payment platform, which took almost two weeks. We then set up an authenticator with cloud sync, added a hardware key for his email and payment system, printed backup codes and saved them in a password manager.

Call a technician

If you want to protect your accounts properly, or you've lost access after changing phones, we'll help in any district of Tbilisi around the clock. Learn more on our computer setup, virus removal and data recovery pages.