Isn't there an SMS option? buy a new phone and have them send you an OTP via SMS.

> once you're phone is gone, you are completely over with society?

yes, I'm waiting for the Black-Mirror episode where someone drops their phone and basically dies, can't contact anyone, can't unlock or start their car, can't get an uber, can't pay for anything, can't navigate without gps, can't log into anything etc.

If you don't have the authenticator backup codes and you didn't turn on cloud sync in the app, you might be out of luck.

You can get a replacement SIM though and use it with a new phone, so the phone number recovery option should work.

This is why my self-hosted Vaultwarden is my one password that I have to remember and requires no 2fa, which is the only important account that doesn't have 2fa.

If I wake up in a bathtub missing a kidney I can still get to my passwords and 2fa sources stored with it. Some accounts require SMS (annoyingly) so I'd have to buy a phone but the auth and credit card numbers I need to do that are in Vaultwarden, too.

I don't have good solutions now for OP (other than buy a new phone through your carrier and transfer the number). But everyone else do think through your personal DRP. Generate backup codes and put them somewhere safe, too.

You're going to have more success working with the providers of the other accounts and services rather than Google. That means a lot more legwork on your part but banks and other online services all have processes to deal with lost passwords and 2FA devices. In some cases you may have to physically go somewhere with ID and other documents.

Consider it a learning experience.

I had similar issues: https://news.ycombinator.com/item?id=45451567 (including my personal domain, Dropbox; my Apple account is still MIA...)

We've all been reduced to a passphrase.

When I've lobbed this scenario to the security managers/employees at these companies, they all give me a really great answer:

Q: What happens if a sitting senator gets mugged and they have their printed 2fa codes sitting in their wallet?

A: They have a special number they can call.

It's a good reminder to everyone who uses 2FA. Be sure you have multiple ways in for when your phone becomes unusable.

Doesn't help obviously if you already lost your phone, but I recommend anyone to use a third party authenticator app. Most services offer to scan a QR code to set up MFA, which can easily be backed up. Don't use Google/Microsoft authenticator apps directly. Personally I use Stratum, but any that allows export/import will do.

All those times you logged in and were prompted to verify your backup email address, and when you set up 2FA and were given recovery codes, and when given the option to sync 2FA codes to another copy of the authenticator app: This Is Why.

I'm sorry you're dealing with this - hopefully everyone else here can take it as a cautionary tale.

I'll fill out a "help my friend" form internally unless someone beats me to it (I have a 1hr meeting coming up). The gmail address in question is the same one as on your website?

Recovery is similar to leaving a copy of your door keys to a trusted neighbour (a tradition in some places, it comes in handy when someone goes out and realizes they forgot the keys inside...), so in that comparison, having a recovery email unused for 12 years feels like leaving your backup keys to a neighbor that you never saw ever again in more than a decade.

This kind of posts are a valuable trigger for all others who are reading it. To the author: good luck, I hope you sort your situation soon! I'm now headed to check my accounts for what recovery options I left in there.

This happened to me on my iPhone 8 many years ago. I reset it to let my son use it, and did not have google authenticator in mind. I had to reset each account with the providers. Now I use a cloud account to sync these. I reset most accounts with an SMS or email one time code -- which led me to remove SMS and email as recovery options from google. And, I put a code on t-mobile to prevent sim transfer.

Everything you listed, plus a recovery email option, plus backup codes, plus SMS.

That's already a lot and anything easier would allow people to just take over accounts that they don't have a right to.

I'm not saying it's the best option or anything but I use authy authenticator which I have on multiple devices.

I got burned by Google authenticator in the past and had to jump through hoops to regain access to my accounts (non Google ones). It was painful. I learned the hard way I suppose.

The only secret option I know of is to have a popular social media account and complain online.

Other than that, I copy/pasted your post into Claude and it had some good ideas.

Well that’s why you should have software 2FA and even backing up the tokens so you can generate that one time code even if you lost access to your main authenticator, having your phone as the only 2FA is like having those yubikey hardware used as 2FA without making a redundant one, losing it, you lost access, which is usually known since no one would use yubikey without being tech savvy to start with, now google or other companies are turning phones as an attestation method for the crowd, you might soon in the future become citizen-less because your digital ID can only be proven in the lost phone.

It's a "feature" that you can't call google to help with getting "locked out":

"For your security, you can't call Google for help to sign into your account. We don’t work with any service that claims to provide account or password support. Do not give out your passwords or verification codes."

for the future: https://support.google.com/accounts/answer/7684753

I can't help you but my comment may help others...

As a techie you should have known better: you first learn how 2FA using TOTP works. You understand what happens when you create an entry in Google Authenticator (or whatever app). You reproduce the procedure: you verify that you end up with the same 6-digit numbers.

If you've got a partner, you register your secret keys for each service on your partner's device and vice-versa.

Then you've got backups of your secret keys on paper, in a safe at your bank. Next to each secret key there's a checkbox: "Successfully initialized from this secret key?".

When those TOTP became ubiquitous (way, way, way before Yubikeys or passkeys were a thing), 2FA was a godsend compared to just passwords.

I understood they were here to stay for years, and years. And then more years.

So I learned how they worked.

When later on QR code generalized to initialize those (IIRC it wasn't a thing in the early days of 2FA TOTP: you'd just always get the secret key as characters, not as a QR code), I refused to ever scan a QR code: I always first decode the QR code (for the services only showing the secret key as a QR code, without also showing it as text), extract a copy of the secret key and then register it from my copy.

Stuff like that.

Now... As most services are deeply broken and have completely insecure practices you just say "I lost my 2FA, I want to reset it" and because they're clueless when it comes to security, they'll allow you to reset it. If someone hacks your email, they pretty much can reset every single of your account (at least those tied to that email).

You can add a passkey (preferably a physical one) to authenticate. You can also add a software passkey but that kind of defeats the purpose.

Actually keeping your recovery options recent is the trick. Print out your recovery codes or store them somewhere safe. Check regularly (yearly, maybe more often) that there's a way to access your critical accounts.

For Google, you can also grab the cheapest Android phone you can find, sign in, and maybe boot it once a month or so to keep the tokens active.

If you've set up your account to only accept one source of 2FA and you lose thst source of 2FA, you lose your account. Same happens when you set up your account to only accept your password and then lose your password. If you lose your recovery email/2FA backup codes, you lose access, unless you're special enough to convince customer support that you are who you claim you are and not just a bot trying to hack you.

If you've lost your account and haven't set up any recovery mechanisms, you're probably out of luck. Your best bet will be looking for an old browser session with enough trust from Google's side to get access without reconfirming your 2FA trust.

The same way you recover any other deleted data for which you didn't make a backup: you don't. You eat the loss & make new accounts. Then you remember to make and test backups for the future.

Even if they had customer support, if that customer support had a backdoor to unlock your account it would be regularly used by malicious parties to steal people's accounts & data.

There's no way, no human contact. That's why I de-googled myself.

While we are on this, is there a comprehensive guide on how to "theft-proof" your iPhone? Not in the sense of preventing the theft, but rather the fallout on all our various online service access.

Using the iPhone backup to setup a new phone is a good reminder every time that not half of the stuff comes back correctly..

need to save your recovery keys (text file) before you lost the phone

Honestly.... This is why I have everything in Bitwarden. All 2FA runs through it so even if my phone got stolen, I could still access everything. I honestly don't understand why more people don't pay the $10 a year and just use Bitwarden.

Dumb question, does backing up my iphone to icloud help solve this? Assuming im willing and able to get a brand new phone? What 2fa would the Apple store need, if hypothetically my lost iphone was my only apple product?

This situation is why I don't use authenticator apps, or passkeys linked to a device. Single point of failure, and obviously with any of the big tech companies, zero recourse.

Have a look at: https://github.com/muquit/twofa-rescue

Try blocking the phone first, then recover your number, and only after that try recovering the account. Or, if you have any backup verification methods through email or something like that, use those.

If you have another device that is logged in, you can get a code from that one to log into your account on your new phone or other device. It is an option but it's kind of buried. There's a special link you go to.

Man, passwords sure are nice aren't they! All you have to do is remember one because your password manager remembers all the rest of your randomly generated passwords for you and as long as you keep a backup of the password database you never have to worry about this bullshit.

You are screwed. I lost access to my account, by trying to buy YouTube premium ironically. If Google even tried to help me I would still use them but they don't, so I switched to Proton and use YouTube with VPN only so they get zero ad revenue :)

Very sorry to hear this, I thought phone theft was becoming rare nowadays. Did it get stolen abroad?

Going forward, consider using an authenticator that securely syncs across multiple devices to remove the single point of failure risk.

I use Proton Authenticator now [0]

Authy used to do this, then they enshittified their app and bricked the desktop version.

[0]: https://proton.me/authenticator

This is why I always have at lest two devices connected to 2fa and a UF2 Security Key

I had some experience similar to this and found that after some months, when logging in on an extremely familiar to Google setup, that there was an additional prompt where it asked for some old passwords IIRC and then let me in.

I went through something like this years ago with my wife and she just scraped enough data together to satisfy the account reset process.

After that we both created a set of one time codes and stored them offline.

All the more reason email and banking should be handled by the post office.

I've had this issue before, and the only thing that saved me was SMS (phone number) backup. I believe Google is slightly easier than Meta to contact by phone so this should help.

The passkey I use for Google syncs to multiple devices, so that's how I handle it. That and a backup code stored in a separate location.

Does your browser have the email password saved?

can you recover one of the old contact points (phone or email) for a reset code?

I would send a paper letter to the Google legal contact. It's the only way to get escalated support.

I agree the covenant for account recovery has been broken. Every 6 months, a new artifact is expected to access the account, without adequate preparation for the recovery.

Too late for you now, but I set my backup email to my work email. Granted, I have to change it when I change jobs.

You were supposed to save your backup codes.

it's too late now but there's an app called Google Authenticator that you could have setup on alternate android devices

your only hope to get your google account back is to convince your phone carrier to transfer your old phone number to a new phone that you control

I mistakenly changed my phone number due to spam call, then i tried to login Google account in another device. Now, this fucking google don't allow me to login at all. It keep saying "Google can't verify you". I have accepted prompts, given them passkeys from 1password, have recovery code and everything. But no lock. I am now scared if my google account gets logged out, i will be in very problematic situation.

Google Employee, can you please fix your shit? Losing phone number doesn't mean you have to lose everything....

I think this

honestly a piece of paper that has your password without saying it is your password and use that password for your most important thing (email) or password manager

[flagged]

[flagged]

[flagged]

[dead]

> or anything to deal with this type of situation?

call sergey brin \s

[dead]