Start by identifying what is lost
Determine whether the phone itself is missing, the authenticator app was deleted, the security key is unavailable, the phone number was transferred, or the linked email is also inaccessible. These situations create different risks.
If theft or unauthorized access is possible, secure the email and mobile account from a clean device. Change reused or exposed passwords and report the lost device to the relevant provider. Do not remotely erase it until you understand whether that would destroy your only recovery path.
Use an existing trusted session carefully
If you are still signed in on a known device, do not log out reflexively. Review the provider's security and recovery options, recent sessions, API keys, withdrawal addresses, and account activity.
Do not disable or replace authentication unless you are on the verified official domain and understand any withdrawal hold or identity check that may follow. Capture non-sensitive reference information needed for support, but never expose codes or setup secrets.
Recover through the official provider flow
Use a bookmarked official website or type the known domain yourself. Look for the provider's authenticator reset or account recovery process. It may require email access, recovery codes, identity verification, device history, or a manual review.
NIST's authentication guidance treats lost or stolen authenticators as lifecycle events that require invalidation and replacement. A legitimate provider may deliberately slow sensitive changes. Do not trust anyone promising an instant reset, guaranteed approval, or a way around identity checks.
After access is restored
Remove the missing authenticator and unfamiliar sessions, rotate exposed passwords, review API keys and withdrawal controls, then register a new method. Confirm notification and recovery settings before moving funds.
Store new recovery codes separately from the primary device. Document which official account and device holds each authentication method without recording the secret itself in an exposed location.
- Revoke the lost authenticator
- Review sessions and login history
- Remove unknown API keys and withdrawal addresses
- Secure email and mobile accounts
- Register and test the replacement method
- Store recovery material separately
Common questions
Frequently asked questions
Can exchange support tell me my old authenticator secret?
Do not expect a legitimate provider to reveal an existing authentication secret. Use its official reset or recovery process to invalidate and replace the lost method.
Should I pay someone to recover my exchange 2FA?
No. Unsolicited recovery services can steal identity documents, credentials, or funds. Use only the process reached from the provider's verified domain or app.
Will resetting 2FA delay withdrawals?
It may. Providers can apply security reviews or temporary restrictions after a sensitive account change. Read the current instructions shown during the official recovery process.
Primary references
Official sources checked
These official pages were reviewed on June 15, 2026. Exchange policies can change, so open the source before acting.