The whole story begins when my cell phone falls into the water and I lose it. Without saving, I migrated from an Android to an iOS, I lost a lot of data that I recovered with a lot of patience. The most annoying thing was getting back access to social media accounts and apps where I registered 2-step verification on Google Authenticator. However, I found that there are some alternatives to do this recovery. So, stay here and check out how to recover accounts that use Google Authenticator even after losing your phone.
- How to strengthen 2-Step Verification Security
- Why SMS 2-Step Authentication is a Bad Idea
First of all…
If you lost your cell phone, your smartphone was stolen — or your device was drowned, my case — the recommended thing is to immediately revoke your “ap passwords” p” and change your Google Account password so that no one uses your security key.
App passwords allow apps or devices that do not support two-way verification codes steps access your Google Account. That is, if you use 2-Step Verification and accessed your Google Account from an app or device, such as Gmail, you probably used an app password.
To remove an app password is very calm:
- Go to the page app from Google;
- You will see a list of apps for which you have created app passwords;
- Next to the app you want to remove access from, click “Remove”;
- If you don't have any, this will also be informed on this page.
Recovering-accounts with two-step verification
If they are Google service accounts, there are some ways to log back in, depending on the circumstances. You can test each of them:
- login on trusted computer;
- alternate smartphone;
- recovery form.
Very similar features worked with non-Google accounts like Facebook, Twitter and Instagram.
When trying to log in, apps will ask for codes from Google Authenticator. All you have to do is click on buttons like “get help signing in” and follow the developer's steps, which can verify your identity in a variety of ways.
Instagram asks you to upload a photo of yourself holding a code sent to your registration email on the platform.
How to recover a login-with-alternative phone
You can request a verification code for your recovery phone added in the “2-Step Verification” of your Google Account:
- Go to the login page from Google service
On the lo pagegin, enter your username and password;
- Select “Try another way”
Next to the button“Next”, click “Try another way”;
- Select “Receive a verification code”
In the two-step definition, you already define how you want to receive this code, by SMS or phone call;
- If you do not receive a code, you can select “More options ” and have other help.
Note: if you received multiple codes, only the most recent one works. If you requested several in a row, it may take a while for the most recent one to arrive.
How to recover-using-a-trusted-computer
If you've previously logged into a computer and checked the option for the computer to remember your password, you can log in to that computer without needing a verification code. Once you are in your account, disable 2-Step Verification:
- Open your Google Account
- Click on “Security”
In the left navigation panel, click the “Security” option with a padlock icon;
- Select “Two-Step Verification”
Click on the option or arrow on the side;
- Log in again
Google will ask you to log back into your account, do that;
- Click on “Deactivate”
On the blue button that appears at the top , click “Disable”;
- Click “Disable” again
A pop-up window will appear to confirm, click again on “Disable”;
- Destroy all the alternate codes you saved to log in to your account.
When you are able to log in to a trusted computer, you can also recover from a set of alternative codes, which you can access or create to do full recovery:
- Log in to your Google Account
- Click on “Security”
In the left navigation panel, click on the option “Security” with a padlock icon;
- Click on “Two-Step Verification”
Under “Signing in to Google” click on the option “Two-Step Verification”. After clicking, you will need to log in again;
- Click on “Backup codes”
In the option with the airplane icon, click on “Backup codes” backup”. Once again Google will ask for your login.
On this page, you can:◦ Receive backup codes: To add backup codes, click on Receive backup codes.
◦ Create a new set of backup codes and disable old codes : To create new codes, click Update .
◦ Delete your backup codes: To automatically delete and disable your backup codes, click Delete .
◦ Download your backup codes: click Download codes .
◦ Print backup codes: click Print .
- If you believe your alternate codes have been stolen or run out, create a new set. To create a new set of codes, click Update.
- When you create new codes, the previous set is automatically inactive.
Take the opportunity to configure an alternative second step . Set up at least one backup option so you can still log in when others aren't available, such as Google Authenticator (use SMS or f-keyU2F/FIDO physics 2).
If you are sure you have saved the codes somewhere… On your computer, search for “Backup-codes-username.txt” using your username at the end. For example, if your username is google123, search for “Backup-codes-google123.txt”.
If you have downloaded it, this is the filename which makes it easier to find it.
Enroll secure devices
You can bypass second-step validation on devices you trust, such as your personal computer. In the “Devices you trust” option, revoke the trusted status of all devices if you have lost one.
Last card: recovery form
If absolutely If that doesn't work, you can still ask Google for help.
Google recommends using the option only if you can't access your account in any other way. The process may take several days to complete:
- Log in to your account
Using your username and password, click to login;
- Click on “Try another way”
On the page where you would put the verification code, click on the option “Try another way”;
- Click on “Get help”
In the last option that appears, click on “Get help”.
Google will ask you a series of questions to confirm that you are authorized to access the account. The form is designed to ensure that only you have access to your account, and this can be tricky if you don't remember the information.
Google may ask when the account was created, what services you use and whom you send emails more often (in Gmail). Without the answers, nothing is done.
Once you've regained access to your Google account and revoked passwords and confirmed your identity to other non-Google apps, you can go back to using Google Authenticator or another verification app in two steps registering all logins again, one by one, scanning QR Codes or including manually.
Extra tips for this process
Do not use Google Voice to receive codes
According to Google, if you use Google Voice service (outside Brazil) to receive verification codes, you may not be able to access your account.
For example: if you log out of Google Voice (log off), you may need to a verification code to return. However, you will not be able to receive a new verification code, because it will be sent to your Google Voice, which you do not have access to.
Bet on encrypted backup with the Authy app
In short, it is not possible to recover Google Autehticator as it was before. You'll need to register all your logins again in the app (and hope you don't lose).
Authy —another two-step verification app— allows you to make encrypted backups in the cloud. If you lose a phone, you can still access accounts from other devices (using the multi-device feature). When purchasing a new phone, you can install the application from Authy , verify your identity and access everything again. There is even a extension to receive the codes in Google Chrome.
With information: Google Account.