Security decision matrix
Identify the threat before changing settings
Fast action helps only when it matches the incident. Start with the account, email, device, and withdrawal path.
| Signal | Likely risk | First safe action |
|---|---|---|
| Unexpected login alert | Possible credential exposure | Secure email first, then review sessions from a clean device. |
| 2FA device lost | Access recovery risk | Use official recovery. Do not pay anyone or share backup codes. |
| Fake support contact | Phishing or recovery scam | Stop replying. Open the provider through a bookmark or typed domain. |
| Unknown API key | Automated account access risk | Revoke it, rotate credentials, and review trades and withdrawals. |
| Withdrawal address changed | Funds may be at immediate risk | Freeze withdrawals if available and contact official support. |
| Account locked | Security, KYC, region, or policy review | Read the exact status and use the matching official appeal route. |
Authenticator recovery desk
Recover access without weakening the account
A lost authenticator is not one problem. The safe path depends on whether you still have a trusted session, the phone was stolen, or all access is gone.
Use the trusted session carefully
Do not log out first. Review security settings, backup methods, withdrawal controls, sessions, API keys, and the provider's official 2FA reset path.
Capture non-secret account facts before starting a reset.Protect email, mobile, and device access
A stolen phone can expose email, SMS, push approvals, saved passwords, and authenticator apps. Secure the linked email and mobile account from a clean device.
Report the device loss and watch for SIM-transfer or password-reset alerts.Check whether recovery material exists
Some users can recover with saved backup codes, cloud backup, a second device, or a security key. Others need the exchange's identity review.
Do not reinstall random authenticator apps from links or chats.Prepare for manual recovery
The provider may ask for account identifiers, device history, identity evidence, recent activity, and a waiting period before replacing the authenticator.
Use one official case and keep the timeline clean.Do not rush this
Fast 2FA reset offers are usually dangerous
- Do not pay someone to bypass identity review.
- Do not share backup codes, setup QR codes, or live 2FA codes.
- Do not install remote-control software for account recovery.
- Do not erase a lost phone until you understand the recovery tradeoff.
Start by identifying what is lost
Determine whether the phone itself is missing, the authenticator app was deleted, the security key is unavailable, the phone number was transferred, recovery codes are missing, or the linked email is also inaccessible. These situations create different risks.
If theft or unauthorized access is possible, secure the email and mobile account from a clean device. Change reused or exposed passwords and report the lost device to the relevant provider.
Do not remotely erase a lost device until you understand whether it contains your only recovery path, such as backup codes, a still-signed-in email app, or a second authenticator copy. That does not mean leaving the device unsecured; it means choosing the order carefully.
Use an existing trusted session carefully
If you are still signed in on a known device, do not log out reflexively. Review the provider's security and recovery options, recent sessions, API keys, withdrawal addresses, notification settings, and account activity.
Do not disable or replace authentication unless you are on the verified official domain and understand any withdrawal hold, identity check, or cooldown that may follow. Capture non-sensitive reference information needed for support, but never expose codes or setup secrets.
If you find unknown sessions, API keys, withdrawal addresses, or security changes, treat the situation as a possible account compromise rather than only a lost-device problem.
Recover through the official provider flow
Use a bookmarked official website or type the known domain yourself. Look for the provider's authenticator reset or account recovery process. It may require email access, recovery codes, identity verification, device history, recent transaction details, or a manual review.
NIST's authentication guidance treats lost or stolen authenticators as lifecycle events that require invalidation and replacement. A legitimate provider may deliberately slow sensitive changes because an attacker could try the same reset path.
Do not trust anyone promising an instant reset, guaranteed approval, employee shortcut, or way around identity checks. Do not send documents, codes, or screenshots through social-media messages claiming to be exchange support.
Prepare a clean recovery case
If automated recovery does not work, send one clear case through official support. State what was lost, whether the device may be stolen, whether email and mobile access are secure, when you last logged in, and whether any suspicious activity appeared.
Keep the case consistent. Repeated reset attempts, duplicate tickets, VPN jumps, and conflicting device information can slow review. If you later discover suspicious logins or withdrawals, update the same case with the new evidence.
Hide full identity numbers and never send passwords, one-time codes, recovery codes, authenticator setup secrets, private keys, or seed phrases. Exchange support can verify identity without receiving secrets that authorize access.
After access is restored
Remove the missing authenticator and unfamiliar sessions, rotate exposed passwords, review API keys and withdrawal controls, then register a new method. Confirm notification and recovery settings before moving funds.
Store new recovery codes separately from the primary device. Document which official account and device holds each authentication method without recording the secret itself in an exposed location.
Expect temporary withdrawal delays after a sensitive security reset. A delay is frustrating, but it can also protect the account from an attacker racing through the same recovery path.
- Revoke the lost authenticator
- Review sessions and login history
- Remove unknown API keys and withdrawal addresses
- Secure email and mobile accounts
- Register and test the replacement method
- Store recovery material separately
Common questions
Frequently asked questions
Can exchange support tell me my old authenticator secret?
Do not expect a legitimate provider to reveal an existing authentication secret. Use its official reset or recovery process to invalidate and replace the lost method.
Should I pay someone to recover my exchange 2FA?
No. Unsolicited recovery services can steal identity documents, credentials, or funds. Use only the process reached from the provider's verified domain or app.
Will resetting 2FA delay withdrawals?
It may. Providers can apply security reviews or temporary restrictions after a sensitive account change. Read the current instructions shown during the official recovery process.
What if I am still logged in on another device?
Use that session carefully. Review recovery options, sessions, API keys, withdrawal addresses, and security notices before logging out or changing 2FA.
Primary references
Official sources checked
These official pages were reviewed on June 15, 2026. Exchange policies can change, so open the source before acting.