Setting Up Two-Factor Authentication That Survives a Lost Phone
Most people set up two-factor in a way that locks them out when the phone breaks. Six steps that do not.
Gabriel Mas ·
Two-factor authentication is the single most valuable account control. Set up carelessly, it is also the most common way people lose access to their own accounts.
Step 1: choose an authenticator app, not SMS
SMS codes can be intercepted by taking over the phone number, which is a routine attack and does not require physical access to the phone.
An authenticator app generates codes offline and cannot be redirected.
Step 2: save the setup secret, not just the QR code
When enabling, the venue shows a QR code and, usually behind a link, the underlying secret as text. Save that text somewhere secure and offline.
This is the step that matters. With the secret, any authenticator app on any device regenerates the codes. Without it, a lost phone means account recovery.
Step 3: enrol a second device
Scan the same code on a second phone or tablet. Both now produce valid codes.
This is supported everywhere and almost never done, and it turns a lost phone from a crisis into an inconvenience.
Step 4: save the backup codes
Most venues issue single-use recovery codes at setup. Save them with the secret, separately from the device.
They are used once each and then crossed off.
Step 5: test before you rely on it
Log out and log back in using the code. Then do it from the second device.
A control that has never been exercised is an assumption.
Step 6: know the recovery process in advance
Read what the venue requires if you lose everything. Usually identity documents and a waiting period measured in days.
Knowing this before you need it tells you how much redundancy is worth building. A platform where each step tells you what happens next publishes its recovery process rather than making it a support surprise.
What to do when you replace a phone
Move the authenticator before wiping the old device. Both apps and both devices, then confirm a login works from the new one.
People wipe first and remember second, which is the most common cause of lockouts.
The combination worth running
Authenticator app on two devices, secret and backup codes stored offline, and a withdrawal allowlist on top. A platform with a withdrawal checklist of its own will support all of it, and Collect & Exchange treats the combination as standard rather than advanced.