I lost my phone or it was stolen

The goal is always the same: remove the lost phone from your account so it can no longer approve, then link a new one. Whoever finds the phone cannot approve without your biometrics or PIN, but do not wait.

I have another factor (passkey or another phone)

1. Sign in to the console with the passkey or the other phone.
2. Open «Protect» › «My phones» and choose «Remove» next to the lost phone. Confirm.
3. When you have a new phone, link it. See Link your phone to your account.

The phone was my only factor

The sign-in page may show «This account has no second factor it can use here. Use recovery or ask an administrator for help.» You have three ways, in this order:

1. Recovery code: «Use recovery». See Sign in with a recovery code.
2. Email link: «I forgot my access details», when your organization allows it and your email is confirmed. See Recover access by email.
3. Ask your organization's support for an authenticator reset. You receive an enrolment code through a separate channel and use it like a recovery code.

Each of these opens a 15-minute recovery session to create one replacement passkey («Complete recovery: create passkey»). Then sign in with that passkey, remove the lost phone under «My phones» and link the new one.

It was stolen

1. Remove it at once (you, with another factor, or your administrator).
2. If someone may also know your password, change it in «Protect» › «Trusted devices» › «Change password», or ask support for a reset with the reason «Suspected compromise».
3. Tell your organization's administrator: it is a security incident and the audit should be reviewed.

What never to do

Never send anyone your recovery codes, enrolment codes or the code your phone shows. Support never asks for them.