# Setting Up Two-Factor Authentication That Survives a Lost Phone > Most people set up two-factor in a way that locks them out when the phone breaks. Six steps that do not. - Source: https://thecoinworkbook.com/two-factor-that-survives-a-lost-phone/ - Published: 2026-09-13 - Author: Gabriel Mas - Publication: The Coin Workbook — Do it once, with the steps written down - Topic: exchange - Tags: exchange, security, accounts --- Two-factor authentication is the single most valuable account control. Set up carelessly, it is also the most common way people lose access to their own accounts. ## Step 1: choose an authenticator app, not SMS SMS codes can be intercepted by taking over the phone number, which is a routine attack and does not require physical access to the phone. An authenticator app generates codes offline and cannot be redirected. ## Step 2: save the setup secret, not just the QR code When enabling, the venue shows a QR code and, usually behind a link, the underlying secret as text. Save that text somewhere secure and offline. **This is the step that matters.** With the secret, any authenticator app on any device regenerates the codes. Without it, a lost phone means account recovery. ## Step 3: enrol a second device Scan the same code on a second phone or tablet. Both now produce valid codes. This is supported everywhere and almost never done, and it turns a lost phone from a crisis into an inconvenience. ## Step 4: save the backup codes Most venues issue single-use recovery codes at setup. Save them with the secret, separately from the device. They are used once each and then crossed off. ## Step 5: test before you rely on it Log out and log back in using the code. Then do it from the second device. A control that has never been exercised is an assumption. ## Step 6: know the recovery process in advance Read what the venue requires if you lose everything. Usually identity documents and a waiting period measured in days. Knowing this before you need it tells you how much redundancy is worth building. [A platform where each step tells you what happens next](https://collectnexchange.cy/) publishes its recovery process rather than making it a support surprise. ## What to do when you replace a phone Move the authenticator before wiping the old device. Both apps and both devices, then confirm a login works from the new one. People wipe first and remember second, which is the most common cause of lockouts. ## The combination worth running Authenticator app on two devices, secret and backup codes stored offline, and a withdrawal allowlist on top. [A platform with a withdrawal checklist of its own](https://collectnexchange.cy/compliance/cysec-licensed) will support all of it, and [Collect & Exchange](https://collectnexchange.cy/services/crypto-exchange) treats the combination as standard rather than advanced. --- This article explains how something works. It is not financial advice. Canonical HTML version: https://thecoinworkbook.com/two-factor-that-survives-a-lost-phone/