Lost Phone With Authenticator? How to Recover Exchange 2FA

Losing the phone that holds your authenticator app does not lock you out forever. Secure your email and phone number first, look for the backup key you may have saved when you set up 2FA, and if you do not have one, use the exchange’s official reset option on the login or security page. Expect an identity check and possibly a temporary withdrawal restriction afterwards. Do not trust anyone who contacts you offering to recover the account.

First hour: protect what still works

A lost phone is also a security risk, because someone else may have it.

• Email: change the password of the email account linked to your exchange, and turn on 2FA for the email if it is not already on. If your email is compromised, the exchange account is next.
• SIM card: if the phone had your SIM, ask your mobile carrier to block it and issue a replacement. This prevents anyone from receiving your SMS codes.
• Device: if you have “Find My” or a similar service, use it to lock or erase the lost phone.
• Other logged-in devices: if the exchange is still logged in on a computer or tablet, check the login history and active devices, and look at your withdrawal address list and API keys for anything you did not add.

Always open the exchange by typing the address or using the official app, not through search ads or links in messages.

Do you have a backup key or backup codes?

When you set up an authenticator, the exchange usually shows a setup key (as text) or a QR code and suggests you write it down. Some accounts also have backup codes. Check:

• Paper notes or a safe where you keep important documents
• A password manager
• Old screenshots, if you saved the key that way (and delete them afterwards)

If you have the setup key, install an authenticator app on your new phone and add the account manually using that key. Your codes will work again without a reset.

Some authenticator apps also offer cloud backup. If you enabled it, signing in to the same app account on a new phone may restore your codes.

No backup? Use the official reset flow

Look for the reset link on the login or verification screen. On Binance it is called Security verification unavailable?: you tick every 2FA method you have lost, click Confirm Reset, and verify with the methods you still have. On OKX it is Unable to verify?, and a reset started on the website sends you to the OKX app to finish. The steps vary by platform and account, but the process usually involves:

• Verifying with the methods you can still use, such as email or SMS, and possibly adding a new phone number or email
• An identity check, which may include an ID photo and face verification
• On some platforms, answering questions about your account

If your request shows as under review, wait for the result. Binance says a review can take up to 24 hours and that you will be notified.

Complete it in one go if you can, using your own original ID and the same device and network you normally use. Note the time of each submission and any ticket number.

After a reset, platforms temporarily restrict withdrawals for security. On Binance, withdrawals, P2P selling, internal transfers and payment services are disabled for up to 48 hours after a 2FA reset. This is normal; the app shows when it ends.

On OKX, an account you have self-frozen cannot reset its authentication methods; follow the support route shown on the login page instead.

Watch out for recovery scams

People who lose access to an account are prime targets. Scammers watch social media and forums for posts about lost 2FA and reply with offers to help. Be clear on these points:

• Official support will not message you first on Telegram, WhatsApp or social media.
• No one needs your password, 2FA codes, seed phrase or remote access to your computer to process a reset.
• No one can pay to “speed up” a security review. The FTC warns that recovery scammers often pose as officials and ask for upfront fees or financial details.

After you are back in

• Set up the authenticator again and save the new setup key offline, separate from your phone.
• Consider adding a second method, such as a hardware security key, so a single lost device cannot lock you out. See setting up a YubiKey on Android.
• Change your exchange password and remove devices you do not recognise.
• Review API keys and delete ones you do not use. Our API key permissions guide explains what to keep.
• Turn on the withdrawal address whitelist if you have not already. See withdrawal address whitelist and network checks.

When to contact official support

Contact the exchange’s official support center if the reset option is not available to you, if your identity check keeps failing, if you no longer have access to the email on the account, or if you see activity you did not make. Give facts: when you lost the device, what methods still work, and your ticket numbers.

Frequently asked questions

Can I recover Google Authenticator codes without the old phone? Only if you saved the setup key or enabled the app’s own backup. Otherwise, use the exchange’s 2FA reset, which replaces the authenticator after an identity check.

Why can’t I withdraw after resetting 2FA? Platforms place a temporary security hold on withdrawals after a security change. Binance disables withdrawals, P2P selling, internal transfers and payment services for up to 48 hours after a 2FA reset. The app shows when it ends.

Someone in a group says they work for the exchange and can reset my 2FA. Should I trust them? No. Use the reset flow inside the official app or website. Anyone asking for codes or remote access is trying to take your account.

I got a new phone with the same number. Does that restore my authenticator? No. The authenticator is tied to the app on the old device, not to your phone number. You need the setup key or a 2FA reset.