A user lost their two-factor authentication device

A user who lost the phone with their authenticator app signs in with a recovery code, or, if the codes are gone too, has their two-factor authentication reset.

Who uses it: System administrator
Permission needed: Create, disable and verify user accounts
In the panel: User Page

A person who cannot reach their authenticator app uses their recovery codes first. If the codes are lost too, you reset the person's two-factor authentication.

The person has a recovery code

On the sign-in screen, after entering their password, the person presses the I can't use my phone — use a recovery code link and enters one of the codes they saved during the setup. Each code works only once. The person's steps are in I cannot access my authenticator app.

The recovery codes are lost too

Confirm the person's identity by phone, through institutional correspondence or in person. Then turn off two-factor authentication with the Reset two-factor authentication action on the user page. The person signs in with their password alone and does the setup again. The steps are in Resetting Two-Factor Authentication.

Remind users to keep their recovery codes in a safe place.