Getting locked out of an account with 2FA enabled is a serious situation, but every major platform has a recovery process. The speed and ease of recovery depends on what backup options you set up beforehand.
In This Guide
Option 1: Use a Backup Code (Fastest)
When you enabled 2FA, you should have been given backup codes — typically 8–10 one-time-use codes. Enter one of these on the 2FA screen where you would normally enter your authenticator code.
Option 2: Recovery Phone Number
Most services allow you to verify with a backup phone number when your primary 2FA method is unavailable. Look for a "Use another verification method" or "Try another way" link on the login screen.
Option 3: Recovery Email
A recovery email can receive verification codes as a backup. Click "Try another way" and look for the option to send a code to your recovery email address.
Option 4: Contact Support
If all else fails, contact the service's support team. Be prepared to verify your identity with:
- Your account email address or username
- Recent activity or login locations
- Payment information (for services with billing)
- Government-issued ID for some platforms
Platform-Specific Recovery Paths
accounts.google.com/signin/recovery → "Try another way" → follow prompts. Google may ask you to confirm recent activity or wait for an email to a recovery address.
Facebook / Instagram
Login screen → "Need more help?" → enter email/phone → select available recovery methods. Government ID verification available if other methods fail.
Apple ID
iforgot.apple.com → select "I can't access any trusted devices" → follow Account Recovery process. This may take 1–7 days depending on your account history.
Twitter / X
Login → "Need help?" → enter email or phone → request verification email or SMS. If 2FA number is unavailable, submit a support ticket at help.twitter.com.
Binance / Crypto Exchanges
These have the most rigorous verification processes due to financial risk. Expect to submit a video selfie with government ID. Recovery can take 2–5 business days.
Going Forward: Prevent Future Lockouts
- Save all backup codes in a password manager immediately after 2FA setup
- Register at least two backup contact methods (phone + email) on each service
- Consider using Authy, which supports encrypted cloud backup of your 2FA tokens
Assess What You Actually Have Access To
Before attempting any recovery path, take stock of what you still have. This determines which recovery path is fastest and most likely to succeed. Check: Do you have backup codes saved anywhere (password manager, printed sheet, notes app)? Do you have access to a recovery email address linked to the account? Do you have a recovery phone number on file? Was your authenticator app cloud-synced (Authy, Google Authenticator with Google sync, Microsoft Authenticator)? Do you have any trusted devices still signed in to the account?
Having even one of these significantly speeds up recovery. None of them available means you will need the service's identity verification process, which takes longer but is still possible for most platforms.
Recovery Path 1 — Backup Codes
On the 2FA verification screen, look for a link such as "Use a backup code", "Try another verification method", or "I can't access my authenticator". Enter one of your saved backup codes to complete sign-in. Once in, immediately update your 2FA setup: re-enrol your authenticator app or switch to a new device, then generate fresh backup codes and store them securely.
Recovery Path 2 — Cloud-Synced Authenticator
If you used Authy with multi-device enabled, install Authy on your new device and sign in with your registered phone number. Your codes sync automatically. For Google Authenticator, install the app on a new device and sign in to the same Google Account — your synced codes appear. For Microsoft Authenticator, sign in with your Microsoft Account and restore from backup.
Recovery Path 3 — Platform Recovery Flows
Every major platform has an account recovery process designed for exactly this scenario. The details differ but the general pattern is the same: prove your identity through information tied to the account without using the 2FA method.
Google: Visit accounts.google.com/signin/recovery. Google may offer to send a code to your recovery email or phone, ask security questions about recent account activity, or verify via a trusted device. The more verification signals Google has for your account, the faster this goes.
Facebook: The "Need more help?" link on the login page offers identity recovery via government ID submission. This typically takes 1–3 business days.
Apple: Visit iforgot.apple.com. If you have no trusted devices and no trusted phone number, Apple initiates Account Recovery — a waiting period that can be days or weeks depending on the account's security history. An Account Recovery Contact (set up in advance) can speed this up dramatically.
Twitter/X: Use the "Trouble logging in" link and choose "I need help with my account" to start identity recovery through email confirmation.
Financial accounts: Call customer service directly. Banks and brokers have identity verification processes over the phone and do not depend solely on 2FA for account recovery.
When Recovery Is Not Possible
Some platforms have strict no-recovery policies for accounts without backup verification methods set up. GitHub warns explicitly that if you lose your 2FA method and have no recovery codes, access may be permanently lost. This is rare but real — it is the strongest argument for always saving backup codes at the time of 2FA setup.
After You Regain Access
Once back in, immediately do these things in order: change your password (in case the lockout was caused by a compromise rather than a lost device); re-enrol 2FA on your new device; generate new backup codes and store them in your password manager; add a recovery email and phone number if they are not already set; and review recent account activity for anything suspicious.
Prevention Is the Real Answer
The one preparation that prevents this entire scenario is saving backup codes when you first enable 2FA. It takes 30 seconds. Store them in your password manager. Every account where you enable 2FA, save the backup codes immediately before closing the setup screen. This simple habit means a lost or broken phone is a minor inconvenience rather than an account lockout.
What to Do in the First 15 Minutes
The first minutes after you discover the lockout set the tone for the whole recovery. Stop and check what you still have before trying anything: is another device still signed in to the account (a tablet, a work computer, a browser session you never signed out of)? Does a family member's device have the app logged in? A still-active session lets you reach the security settings and change your 2FA method without any recovery flow at all.
Second, do not hammer the 2FA screen with guesses. Repeated wrong codes can trigger a temporary lock on the account itself, which stacks a second lockout on top of the first. Third, do not factory-reset or wipe the device that holds your authenticator app — even a phone with a cracked screen can usually still generate codes or back up its authenticator data. Finally, if you find an old backup of your phone on a computer, pause before deleting anything; some authenticator apps can be restored from those archives.
What Not to Do When You're Locked Out
Lockouts attract a specific kind of scam. Never pay a "recovery service" that promises to get you back into your account for a fee — legitimate platforms have their own free recovery processes, and these services almost always end with a stolen account and an empty wallet. Never give your password, backup codes, or a live 2FA code to someone who contacts you claiming to be support; real support never asks for those.
Beware of lookalike support pages. When you search for "account recovery" for your platform, sponsored or SEO-stuffed results sometimes lead to phishing sites that harvest the credentials you enter. Go directly to the official domain (accounts.google.com, facebook.com/login/identify, and so on) by typing the address yourself. Also avoid creating a new account with the same email to "start over" — that complicates recovery of the original and muddies which account holds your data.
Building an Emergency Lockout Kit Before You Need One
The single best investment is a small, physical lockout kit assembled now and stored somewhere safe: a printed page of backup codes for each important account, the secret keys or backup files for your authenticator apps, and a note of which recovery email and phone number are on file for each service. Keep a second copy off-site — with a trusted family member or in a safe deposit box — because fires, floods, and stolen bags do not respect digital backups.
Also record your authenticator app's master password or encryption passphrase if it uses one (Authy and Aegis both do). People often secure an authenticator app with a strong password and then discover, when locked out of an account, that they never wrote that password down either. The kit should also list the official recovery URLs for each platform — one page of paper saves hours of panicked searching at midnight.