Lost or New Phone: Moving Google Authenticator and Exchange 2FA, or Resetting It

Old phone still works? Move the codes before you wipe it or hand it in. In Google Authenticator on the old phone, tap Menu > Transfer codes > Export codes, then scan the QR code it shows with Menu > Transfer codes > Import codes on the new phone. On an iPhone the labels say “accounts” where Android says “codes”. Full steps, and the test to run afterwards.

Old phone lost, stolen or broken? Install Google Authenticator on the new phone and sign in to your Google Account. Codes that were synced there come back by themselves. If yours don’t, the app has nothing to restore, and the way back in is a backup you saved at setup or each exchange’s own 2FA reset:

Old phone still works: transfer the Google Authenticator codes, then test them

How you copy depends on whether Google Authenticator is signed in to a Google Account.

It’s signed in. Install the app on the new phone, tap Get Started and sign in to the same account. Google’s help page says your codes are then “automatically synced to this device”. Syncing needs version 6.0 or above on Android, 4.0 or above on iOS.

It isn’t, or you’re not sure. Export. You need the old phone with the codes, the latest version of the app on it, and the new phone.

1. On the new phone, install Google Authenticator, tap Get Started and sign in to your Google Account, as Google’s steps do.
2. On the old phone, tap Menu > Transfer codes > Export codes (Transfer accounts > Export accounts on an iPhone or iPad). The phone asks you to get past its screen lock.
3. Select the accounts to move, every exchange entry included, and tap Next. With several accounts, the old phone may show more than one QR code.
4. On the new phone, tap Menu > Transfer codes > Import codes (Transfer accounts > Import accounts on iOS) and scan each QR code.
5. Wait for the confirmation that your codes have been transferred.

Then test, before the old phone goes anywhere. We’d sign in to each exchange with a code from the new phone while the old one can still step in. If a code is refused, Google’s checklist is short: entered before it expired, for the correct app or service and the correct account, and the phone’s time synced and correct for your local time zone. Since version 7.0 the app uses the phone’s own time setting.

When every entry works, we’d wipe the old phone as a whole rather than deleting codes one by one, because Google’s page says that if your codes sync, a code you delete is also deleted from all devices where your codes are synced.

Passkey-only setting switched on? Binance has an option that makes a passkey compulsory for logging in and withdrawing. Its page says to switch it off before changing to a different mobile device, logging in to a new iCloud account, changing passkey settings in the phone’s system settings or reinstalling its app. With it on, you can’t log in if you lose access to your passkeys, and the page sends you to the 2FA reset.

Another authenticator app? Check first whether your app can export to the new device. If it can’t, change the authenticator on the exchange while the old phone still makes codes. The three exchange pages that describe a change put the option under Security; in the OKX app the path reads Profile and settings > Security > Authenticator app > Change authenticator app. You pass a security check, then link the new phone by scanning a new QR code or entering the setup key. If the exchange asks for a second method first, such as a hardware security key or a cross-device passkey, add it before you delete the old sign-in 2FA. Two exchanges say a change made this way also starts their 24-hour withdrawal pause.

Moving Microsoft Authenticator to a new phone

Microsoft Authenticator moves codes with a cloud backup, and its help page says accounts backed up on an iOS device can’t be restored on an Android device. Third-party codes that refresh every 30 seconds, the kind an exchange entry makes, come back after a restore.

On Android, tap the three-dot icon in the app, then Settings, turn on Cloud Backup and choose the Microsoft personal account to store it in. On the new phone, select Restore from backup before you sign in to any account in the app, then sign in with the Microsoft personal account you backed up to. Microsoft’s page says that from January 2027 the Android backup is switched on from Google One backup instead of a Microsoft personal account.

On an iPhone, turn on iCloud Drive, iCloud Keychain and iCloud Backup, and switch on Authenticator in your Saved to iCloud list. On the new iPhone, turn on the same three iCloud settings, then install and open the app. If the codes don’t appear, Microsoft says the old phone needs version 6.8.33 or later, opened at least once before the switch, and the app on the new one uninstalled and reinstalled.

Between an iPhone and an Android phone the backup can’t help, so change the authenticator on each exchange first, or reset and link the new phone from scratch.

Old phone gone: start from what you still have

Deal with the lost phone first. Google’s page says to make sure nobody else can reach its codes, using the remote erase option for iOS or Android. Where that isn’t available, synced codes come off when you remove the device from your Google Account. For codes that aren’t synced, the page says you “need to visit every site that you have Google Authenticator set up on to remove the codes, and then relink your new device.” On an exchange, that visit is the 2FA reset. If your email was signed in on the lost phone too, change that email account’s password and 2FA as well.

The codes came back after you signed in. No reset needed; test them as you would after an export. If the app opens empty instead, rule out Google’s two causes before you start a reset: you may have been signed out of your Google Account (check the profile icon at the top right), or the codes were saved under another Google Account, so switch to it.

The sign-in prompt offers another method. Look on the code prompt for an option to switch to another verification method, and sign in with whatever else your account has: an SMS, voice or email code, a second sign-in 2FA method, or a Master Key. Once in, replace the authenticator as in the steps for linking a new phone; a change made this way can still start a 24-hour withdrawal pause.

You kept the backup from setup. Bybit shows a Recovery Key Phrase once, when you link the authenticator, as a QR code or a string of letters and numbers, and doesn’t store it. To use it, tap + in Google Authenticator, choose Manual entry and put the phrase under Key. A 2FA backup code recorded at setup, or a Kraken Master Key, gets you past the sign-in prompt instead, though a Master Key can’t be added once sign-in 2FA is already lost. Whichever you use, change your 2FA as soon as you’re back in, because a backup of a 2FA that sits on a lost phone isn’t secure.

Your email or phone number still gets codes. This is the self-service reset: tell the exchange which method is unavailable, then confirm with codes sent to what you still have. They can go to both the registered email and the mobile number, and they don’t last long: 15 minutes on one exchange’s reset page. If your account passed an advanced identity check, a face scan may stand in for the codes, and a reset can go on to a questionnaire about the account, supporting proof, an ID photo and a video of you holding the ID, with your UID, email, phone number, the date and the reason written on paper. The Binance 2FA reset, screen by screen, with what Application Denied and Under Review mean has each step. If a code never shows up, go through the email and SMS delivery checks in order before you start a new request.

The SIM went with the phone. If SMS was one of your methods, two are now gone. Tick every lost one in the same request. Choosing two or more can mean live or video verification, which on one exchange stretches the review from 1 business day to 3–5. If a face scan stalls along the way, the four places a liveness check stops apply here too.

Neither email nor phone works. Then the way back is a case handled by support. The exchanges that describe it take a manually submitted case or a support request, and support gets back to you by email; one exchange gives 1–3 working days for a manual case. Wait that out before you send a second case; Bybit asks you to re-submit only after three working days. OKX says an account you froze yourself can’t have its authentication methods reset, and points people who can’t sign in to the assistance on its login page.

Then there’s help you didn’t ask for. One exchange’s page says it will never ask for your password, 2FA codes or recovery phrase. A message or call offering to get you back in, when you didn’t ask, is one we’d leave unanswered until you’ve run five checks on “exchange support” calls and texts.

After a reset, link the authenticator to the new phone

Several resets end with the old authenticator switched off, unlinked or lifted from the account by a support agent, not replaced. Linking the new phone is then a separate step under Security, where the setup pages call it Authenticator App, Google Authenticator or Sign-in Two-Factor Authentication.

1. Sign in with the methods you still have and open Security in your account settings, where the authenticator has its own entry. On Binance’s website that’s Profile > Account > Security, then Manage next to Authenticator App and Enable Authenticator App.
2. Pass the security check. Depending on the exchange, that can mean confirming the change with a passkey, an authenticator code or your Master Key, or simply completing its two-factor verification.
3. In the authenticator on the new phone, tap + and choose Scan a QR code. If the code won’t scan, choose Enter a setup key and type the key shown with it.
4. Check that the new entry has appeared, and don’t click Next until the setup is complete.
5. Enter the current 6-digit code from that entry. Codes refresh every 30 seconds; if one fails, try the next.
6. Wait for the confirmation, which may come by email or SMS.

Two entries for the same exchange. An old entry that came back with a sync or a restore can sit beside the new one, still making codes for the authenticator the exchange removed. After you set up 2FA again, remove the old entry from the authenticator to avoid confusion. In Google Authenticator on Android, swipe right on it to delete it.

Several 2FA codes on one account. Kraken lets you set up a separate 2FA for sign-in, funding, trading and a Master Key. Once sign-in 2FA gets you back in, its transfer page says, the other three can be removed without the originals, unless the Global Settings Lock is on, and set up again from scratch. Label each entry so you know which is which; in Google Authenticator on Android, swiping left on a code lets you edit its username.

The screen shows a backup key or recovery phrase. Save it before you finish (what each kind can stand in for).

How long are withdrawals paused after a 2FA reset?

Most of the six exchanges stop withdrawals for 24 hours after the authenticator is reset, changed or removed; the longest pause is up to 48 hours. Both figures are as the help centres gave them in October 2026, and if a withdrawal hangs on either one, check the wording there today first.

What stops varies from exchange to exchange: besides crypto withdrawals, it can take in P2P trades, internal or fund transfers, card transactions and payment services. Where a page says how the pause ends, it lifts by itself when the period is over.

If you need to move funds on a given day, start the reset well before it.

If you also change your phone number or email after the loss, expect a pause for that too. Two of these exchanges list a 24-hour withdrawal restriction after either change, and neither says whether two changes made on the same day share one pause. Binance’s timed holds after a password or other security change are set out with the page each comes from.

Copying codes to a new phone appears in none of these hold rules. An export moves the same entry from one app to another and changes nothing in your exchange account, which is why we’d export while the old phone still works.

Will a passkey survive the change of phone?

Where you save a passkey decides whether it outlives the phone. A passkey in iCloud Keychain syncs across Apple devices on the same Apple ID, and one in Google Password Manager syncs with your Google account. Saved to a Chrome profile, a passkey stays on that one device.

A passkey is confirmed with a biometric check, your phone’s screen lock or a security key rather than a typed code. Kraken recommends passkeys for sign-in because they only work on its real site, leaving no code to enter on a fake site or share with a scammer, and allows up to five passkeys alongside one authenticator app.

The phone with the passkey is gone. Start the 2FA reset from the exchange’s login page. If a passkey pop-up appears, cancel it, choose the option saying your passkeys aren’t available, and carry on with the reset.

Removing a passkey can itself restrict withdrawals for 24 hours, so clear out old ones on a day you don’t need to withdraw.

Keep a backup so the next lost phone is a small problem

Google’s case for syncing is that saving codes in your Google Account “helps protect you from being locked out of your account when you change devices.” Its best practices add Privacy Screen (Menu > Settings > Privacy Screen), which asks for a PIN, pattern or biometric check (Face ID or Touch ID on an iPhone) before the app opens. If you use the app for your Google Account too, Google suggests enrolling in other forms of 2-Step Verification so you don’t lock yourself out.

Keep the setup backup off the phone. A setup key, a backup key or recovery phrase, and a Master Key can each stand in for the phone, so a copy kept on the phone is lost with it.

Treat any of these like a password. One exchange’s transfer page shows that typing its phrase into an authenticator is enough to produce your codes.

Add a method that doesn’t live on this phone. A passkey saved to a password manager that syncs, or a hardware security key kept apart from the phone, isn’t lost with the handset.

Most of these resets confirm it’s you through a method you still have. Keep at least one that a lost phone can’t take with it, such as an email inbox you can also open on a computer.