Your phone is lost, and although you know your account password, the second authentication factor was only available on that device. An analysis of recovery procedures from Google, Apple, Microsoft, as well as 1Password, Bitwarden, and Dashlane shows: after losing access, it is impossible to set up backup methods retroactively, and in some cases, the account becomes permanently inaccessible.

Losing the Second Factor: What Happens

If your phone is stolen or lost and the second authentication factor was only set up on it, regaining access depends on the backup options you prepared in advance. The decision on whether recovery is possible is essentially made at the moment you enable two-factor authentication, not after the device is lost.

Account Recovery with Major Providers

Google

Google allows you to use another authorized phone, an additional registered number, backup codes, a hardware security key, or a passkey from another device for recovery. Backup codes are ten one-time eight-digit numbers that you can generate in advance. When you create a new set, the old codes become invalid.

Apple

Apple treats the iPhone passcode as a full-fledged recovery factor. This code is used to reset your Apple ID password and recover encrypted data if you lose access to your account. The passcode serves functions beyond simply unlocking the screen.

Microsoft

Microsoft does not provide a set of backup codes. There is only a single 25-character recovery code, which cannot be reissued. If this code is lost, account recovery is impossible.

Recovery Waiting Times

Recovery procedures take time. Google states that verification can take 3–5 business days, and changes to security settings only take effect after a week. Apple does not specify exact timeframes, but the minimum waiting period is several days. If you change all security data with Microsoft, your account is locked for 30 days, and the only way to speed up the process is to cancel the request using previously available security methods.

Specifics and Limitations

• With Microsoft, the 30-day lock can only be canceled using the lost device or an alternative authentication method.
• Apple automatically cancels the recovery process if the account is used on any device other than the one from which the request was initiated.
• A backup of the authenticator app does not always help: for Microsoft passwordless accounts, only the account name is stored in the backup, and accounts saved on iOS cannot be restored on Android.

Password Managers: Recovery and Limitations

With Google and Apple, recovery is possible if you can confirm your identity. For Bitwarden, 1Password, and Dashlane, recovery depends on the account type and whether you have previously saved codes or trusted contacts:

• Bitwarden cannot recover your master password or second factor. If you lose them, you must create a new account.
• 1Password: The 34-character Secret Key is not a backup code. Since 2024, a separate recovery code is available, but it only works if you have access to the email address linked to your account.
• Dashlane can send new codes via SMS if the second factor is lost, but does not reset the master password. Recovery is possible using a recovery key or biometrics on Android and iPhone.

Security Setup Recommendations

• Print your backup codes and store them in a safe place. Do not photograph them or save them in the password manager you are protecting.
• Add a second factor on another device: a tablet, an old security key, or an authenticator app on your computer. Relying on just one phone is the main mistake.
• Add trusted contacts in advance: Google allows up to 10, Apple up to 5. Activation takes time (two weeks for Google).
• Be careful with the recovery key: if you activate it with Apple, the standard recovery procedure becomes unavailable. Losing both the key and your devices will result in permanent loss of access to your account.

Conclusion

Regaining access after losing your second factor is only possible if you have prepared backup methods in advance. For most services, setting up additional recovery options and keeping backup codes safe is the only way to avoid losing your account entirely.