How to Move 2FA to a New Phone Without Getting Locked Out

Why Your 2FA Codes Don't Follow You Automatically

Switching phones should be simple: sign in, restore your data, done. Authenticator apps break that pattern. The codes protecting your accounts are generated from secret keys stored on the device itself — and a new phone's freshly installed app knows none of them.

When you enabled two-factor authentication, each service gave your app a unique secret. The app keeps that secret locally and uses it to generate a new code every 30 seconds or so. Nothing on the service's side can regenerate your app's contents for you.

This design is deliberate. A secret that lives only on your device can't be intercepted from a server breach, but it also means the device is the single copy. Lose it without an export, and the secret is gone.

Some apps offer cloud backup or sync, but only if you turned it on in advance — and many people never did, assuming it happened automatically. Others encrypt the backup with a passphrase you chose at setup; a new phone can restore the data only if you still know that passphrase, so dig it up now. Without any backup, wiping or selling the old phone erases every secret at once.

Skipping the transfer is the most common self-inflicted account lockout. The fix takes minutes, and it starts before you touch the new phone.

Before You Switch: Prepare Both Phones

A few minutes of preparation now prevents a lockout later.

Inventory your 2FA accounts. List every account protected by 2FA and note which app generates each code — Google Authenticator, Microsoft Authenticator, Authy, or a built-in option like the one in your password manager. Check your email, banking, social media, cloud storage, and work accounts; people routinely forget one or two until they need them. A simple note on paper or in a text file is enough.

Save backup codes. Download or print the backup codes from each service while you still have access. Store them somewhere safe and offline. These codes work even if both phones fail. Many services show the codes only once, so if you skipped saving them at setup, regenerate a fresh set now rather than assuming the old ones still work.

Check recovery details. Confirm the recovery email address and phone number on your important accounts are ones you still control. An old number on file can block account recovery later — a common trap when switching carriers.

Keep the old phone alive. Leave it charged and connected to Wi-Fi until every account works on the new phone. Wiping it too early is the most common cause of lockouts.

Export Accounts From Your Old Phone

How you export depends entirely on which app you use. There is no universal method, so start by opening your current authenticator and checking its settings.

Google Authenticator: Open the app, tap your profile picture or the menu, then choose Transfer accounts → Export accounts. Select the accounts to move and the app displays a QR code (or several, if you have many accounts). You will scan these on the new phone. The codes are time-limited, so do this when you are ready to import immediately. Two practical tips: do it in a quiet, well-lit room — a failed or partially scanned QR code is the most common cause of a missing account after the move — and export all accounts in one session, because there is no easy way to tell later which ones you already moved.

Microsoft Authenticator: This app does not export QR codes. Instead, turn on cloud backup in its settings (it uses iCloud on iPhone, or your Google account on Android). On the new phone, install the app and choose to restore from backup during setup. Check the backup screen first: it should show a recent date and the number of accounts saved. If it says backup is off, or the date is old, the restore will silently miss accounts.

Authy and similar apps: These sync accounts across devices through your account. Install the app on the new phone, verify your identity, and approve the new device — your tokens appear automatically. Make sure multi-device is still enabled in the app's settings before you start; if it was turned off, the new phone cannot be added until you re-enable it on the old one.

If your app offers none of these options, see the next section.

Import and Verify on the New Phone

Install the same authenticator app you used before. Switching apps (say, from Google Authenticator to Authy) can fail mid-transfer, so match apps first. If your old phone showed an export QR code, open the app's import or "transfer accounts" option on the new phone and scan it. Hold the phones close — the QR code often expires within a minute. If you saved a backup file or backup code during export, use the app's restore option instead, and keep that file somewhere only you can reach it.

Apps that sync through an account work differently: install the app, sign into the same cloud account, and approve the restore. Your codes should reappear without scanning anything. Watch for a verification prompt on the old phone — approving it is part of the restore, not a phishing attempt.

Once the accounts are listed, test each one:

• Open the account's website or app on another device and sign in with your password.
• When prompted, enter the current 6-digit code from the new phone.
• Confirm you're logged in before testing the next account.

Codes refresh every 30 seconds or so, so enter them promptly. A common mistake: typing the code after the timer resets mid-entry. If any account rejects the code, don't wipe the old phone — re-export or fix that account first.

Handling Accounts That Can't Be Exported

Some services deliberately block export. Banking apps and certain work accounts keep secrets locked to one device, so a stolen export file can't be copied to someone else's phone. You can't transfer these—you have to re-enroll.

Before you wipe anything, list these accounts. Scan your old app for entries from banks, employers, government portals and anything that refused to export when you originally set it up. Trying to reconstruct the list from memory after the old phone is gone is how lockouts happen.

Re-enroll on the New Phone

1. Log in to the service from a computer.
2. Open its security or two-factor settings.
3. Choose the option to set up an authenticator app. A fresh QR code appears.
4. Scan it with your new phone's app.

If the service also shows backup codes, save them somewhere safe now. This is your fallback if the new phone is lost or broken later.

Remove the Old Enrollment

Once the new phone generates working codes, go back into the same settings and delete the old device's entry, or re-scan if the service only allows one active app. Leaving a stale enrollment means a phone you no longer control still counts as a trusted factor. If you sold or traded in the old device, this step matters even more: whoever holds it may still have valid codes.

Test the new codes before logging out of the computer. Enter one code in the service's verification prompt while the session is still open—mistyped or time-drifted codes are easier to fix with a working session than from a fresh login.

Verify Everything Before Wiping the Old Phone

Codes on the new phone mean nothing until they've opened a real account. Test before you erase anything.

• Pick one or two critical accounts — email first, then banking or your password manager. Your email is the recovery hub for almost everything else, so proving it works matters most.
• Sign out or use a private window, then sign in with a code from the new phone. A private window forces a fresh login, so you can't accidentally pass the test with a session that was already open.
• If the code works, the transfer for that account succeeded.

Check every account the same way, not just the first two. A single silent failure — an account that never imported — is enough to lock you out later. Migration apps sometimes skip entries quietly, especially if an account used a non-standard setup like a custom time step. Work through your list one line at a time and tick each one off.

Only factory reset the old phone once every account opens from the new one. An unverified wipe is the single biggest avoidable lockout risk in this whole process. If you reset first and find a broken account afterward, your only options are account recovery flows, which can take days or fail entirely.

Old phone keeps working until the last account checks out. Then wipe it — and only after confirming that reset prompt, since the old codes die permanently at that moment.

If You're Already Locked Out

Locked out doesn't mean the account is gone. Work through these options in order.

Try Your Backup Codes

When you set up 2FA, most services gave you backup or recovery codes — designed for exactly this situation. Check printed copies, your password manager, or old screenshots. Each code typically works once. Sign in with your password, choose the recovery code option when prompted, and enter one.

Watch for common mix-ups: some services number their codes, and people mistakenly cross out the wrong one after use. If a code fails, confirm you're entering the correct next one on the list, not a code you already burned during a previous sign-in. Letter/number ambiguity (0 vs O, 1 vs l) is another frequent culprit — try the alternate character if a code is rejected. If one code fails twice, stop guessing; some services lock the account temporarily after repeated failed recovery attempts, making a bad situation worse.

Use the Service's Account Recovery

No backup codes? Every major service has its own recovery process. Some verify your identity with documents, others rely on an alternate email or phone number. Always start from the service's official sign-in help page. Ignore anyone claiming to be a "recovery agent" who contacts you first — that's a scam.

A practical tip: recovery often hinges on details you set long ago, like an old phone number still linked to the account or a device you've signed in from before. Gather this information before starting, because some processes time out if you can't answer promptly.

Contact Support Directly

If automated recovery fails, contact the service's support team. Available options depend entirely on their policies. Be ready to prove ownership with details like the account creation date or billing information. Response times vary; banks and email providers often take longer because the stakes are higher.

Be patient and persistent. Follow-ups referencing your original ticket number usually keep cases moving.

After the Move: Stay Lockout-Proof

The transfer is done, but lockout risk isn't. Three habits keep it away.

Refresh your backup codes. Codes from before the move may be half-used or stale — if you dipped into them during the switchover, some are already burned, and a set missing three of ten codes is a trap you'll only discover mid-emergency. Generate a fresh set for each important account and store them offline — printed or written down — somewhere separate from your phone: a safe, a locked drawer, a trusted relative's home. Backup codes saved in your phone's notes app defeat their own purpose: the device that fails you is the one holding the fallback. If you keep the codes at home, keep a second copy elsewhere; a house fire or theft shouldn't take your recovery with it.

Check your recovery details. Open each account's security settings and confirm the recovery email and phone number are current. An old number you no longer control is both a door for someone else — carriers recycle numbers — and a recovery path you can't use. Do this the same week as the move; later means forgetting.

Adopt passkeys where offered. Passkeys sync across your devices through your platform account, so a lost phone no longer means lost access. Enable them alongside, not instead of, your TOTP apps until every account is covered.

The short version: export before the switch, verify before wiping, keep backups offline. Do that, and your next phone upgrade is routine, not a rescue mission.