Losing a 2FA device is stressful because it combines two problems: you may have lost a physical device, and you may also be locked out of accounts that keep your work running.
The right response is not to panic-reset everything. Move in order: protect the lost device, preserve any accounts that are still signed in, recover critical accounts first, replace MFA methods, and document what changed.
This guide is written for freelancers, solo founders, and developer-consultants who are their own IT department.
The short version
If your 2FA phone, passkey device, or security key is lost, first protect the device and any sessions that remain available. Then recover accounts in priority order: primary email, password manager, domain registrar, cloud storage, GitHub or code hosting, payment tools, and client workspaces.
Use backup codes, alternate passkeys, security keys, trusted devices, or official account recovery flows. After access is restored, remove the lost device from each account, generate fresh backup codes, and update your recovery note.
Step 1: Decide whether this is loss or theft
The response is different if the device is probably under a couch versus stolen in a public place.
If it may be stolen, use the platform’s lost-device tools as soon as practical. Lock the device, mark it lost, or erase it if the risk is high and backups are in place. Change the password for the platform account that controls the device if you suspect compromise.
If it is likely just misplaced, avoid destructive actions until you know whether wiping the device would remove your only MFA method.
Step 2: Do not sign out of working sessions
If you still have a trusted laptop or browser session signed in to critical accounts, do not sign out casually. Those sessions may be your easiest path to update MFA settings, download fresh backup codes, and add a replacement device.
Start with primary email and password manager. If those still work, you have a much better chance of recovering everything else.
Step 3: Prioritize accounts that recover other accounts
Do not start with low-impact apps. Work through the recovery chain:
| Priority | Accounts |
|---|---|
| 1 | Primary email and password manager. |
| 2 | Domain registrar, DNS provider, cloud storage, device ecosystem account. |
| 3 | GitHub or code hosting, payment tools, client workspaces. |
| 4 | Social accounts, newsletters, low-impact SaaS tools. |
If primary email is secure and accessible, many other recovery flows become easier. If the password manager is accessible, you can find recovery codes and account notes.
Step 4: Use backup codes or alternate methods
For each critical account, look for official recovery options:
- backup codes
- alternate authenticator device
- alternate passkey
- hardware security key
- trusted device
- verified email flow
- admin recovery for work or team accounts
- official support recovery
Do not use random recovery advice from forums for high-value accounts. Use the provider’s own recovery flow.
If you need to understand the difference between recovery materials, see Backup Codes vs Recovery Keys.
Step 5: Replace MFA before removing the old method
Once you regain access, add the replacement method before removing the lost one whenever the service allows it.
A safer order is:
- sign in with an existing method
- add the new phone, passkey, authenticator, or security key
- save new backup codes
- test sign-in with the new method
- remove the lost device or old authenticator
- review active sessions
If you remove the old method too early and the new one fails, you can turn a recoverable problem into a lockout.
Step 6: Check active sessions and devices
After replacing MFA, review signed-in devices and sessions. Remove the lost phone, unfamiliar browsers, old laptops, and sessions from places you do not recognize.
Do this especially for primary email, password manager, GitHub, cloud storage, payment accounts, and domain registrar accounts.
If the device may have been stolen and unlocked, also rotate credentials that were stored on it or accessible from it.
Step 7: Replace backup codes
If you used a backup code, generate a fresh set when possible. If the old set may have been stored on the lost device, revoke it and create a new one.
Update your offline copy and destroy stale copies. Your future self should not have to guess which backup-code sheet is current.
For storage options, use Where To Store Backup Codes And Recovery Keys.
Step 8: Handle GitHub and developer tools carefully
Developer accounts often have extra credentials beyond the login method. If a work device is lost, check:
| Area | What to review |
|---|---|
| GitHub sessions | Remove the lost device and unknown sessions. |
| SSH keys | Remove keys tied to the missing machine if applicable. |
| Personal access tokens | Revoke tokens stored on the lost device. |
| Local secrets | Rotate API keys from local .env files or scripts. |
| Client access | Notify clients if their systems may be affected. |
For more detail, use How To Secure Your GitHub Account.
Step 9: Write down what changed
During recovery, you may change devices, regenerate codes, rotate keys, remove sessions, and update phone numbers. If you do not record it, your recovery plan will be stale by the time you need it again.
Update your recovery note with:
- date of incident
- accounts affected
- MFA methods replaced
- backup codes regenerated
- devices removed
- credentials rotated
- remaining follow-up tasks
Do not include raw passwords in this note.
Common mistakes
The first mistake is wiping the lost phone before confirming you have another way into critical accounts. Sometimes wiping is necessary, but understand the recovery impact first.
The second mistake is starting with minor accounts while primary email and password manager are still unresolved. Recovery order matters.
The third mistake is replacing MFA but leaving stale backup codes, lost-device sessions, and old tokens in place. Recovery is not finished until the lost device can no longer be used.
Good next step
Before anything is lost, run a small drill: can you access primary email, password manager, and GitHub without your daily phone? If the answer is no, fix that before travel or device replacement.
Related guides:
- How To Avoid Account Lockout When Using MFA
- Security Key Backup Plan
- Solo Founder Account Recovery Plan