PC Two-Step Verification When You've Lost or Replaced Your Phone
In plain English: Losing or replacing your phone does not mean you have lost your Microsoft account. You can still sign in if you have another way to prove it is you, such as a backup email, a second phone number, or a saved recovery code.
First safe step: Start the sign-in as you normally would, with your email address and password. When Microsoft asks for a code from the old phone, do not keep trying that same option. Look on the prompt for a link to use a different verification method or show other verification methods.
Losing or replacing your phone does not mean you have lost your Microsoft account. You can still sign in if you have another way to prove it is you, such as a backup email, a second phone number, or a saved recovery code. Start with those options before you replace your security info.
Work through the choices in order, trying another sign-in option already on your account first, and then a saved recovery code if you kept one. Only if neither works should you replace your security info, which is the slower route covered later in this guide.
If you do have to replace your security info, Microsoft adds a 30-day wait. That wait can sound alarming, but it does not mean your account or files will be deleted. After you are back in, you will add your new phone and a spare way to sign in.
Part of the Locked Out of Your Microsoft Account, Outlook or Windows? Recovery in Plain English series, the pillar guide for this cluster.
First, try another way to sign in
Start the sign-in as you normally would, with your email address and password. When Microsoft asks for a code from the old phone, do not keep trying that same option. Look on the prompt for a link to use a different verification method or show other verification methods. Selecting it lists the other methods already saved on the account.
Work through that list and try each one you can still reach. A backup email address can receive the code if you can open that inbox. Another phone number on the account may let you get the code by text or by a voice call. If one method works, use it to sign in and finish getting back in.
Also check a computer, tablet, or other device where you may already be signed in to your Microsoft account. A browser with Outlook still open counts for this, too. Leave that sign-in open and do not sign out. From there, you may be able to approve the new sign-in when prompted, or open your account security page to see which phone numbers and email addresses are listed.
If none of those options is available, the lost phone may have held the only method on the account. Stop at that point rather than trying the same prompt again. The next steps are the saved recovery code route, and then security info replacement if you do not have a code. You have not run out of options yet.
Use a saved recovery code if you have one
When you first turned on two-step verification, Microsoft offered you a recovery code to save for a day like this. Look for a printout in your home files, an entry in your password manager, or a note you saved at that time. Try searching the password manager for Microsoft or recovery code.
Microsoft calls it a recovery code, in the singular. That is different from some other services, which give you a set of backup codes to use one by one. You have one code for this account, and you can use it only once.
Check that what you found is the right code before you type it. It is not the six-digit code from the authenticator app, and it is not a 48-digit BitLocker recovery key. Do not enter either of those in its place.
At the code prompt, choose the option to use a recovery code, enter the code exactly as you saved it, and complete your sign-in. Microsoft will then give you a replacement code. Save the new code in a safe place right away and check that you can read it, because the old one will not work again.
Replace your security info when nothing else works
If none of the other sign-in methods worked and you do not have a saved recovery code, you can ask Microsoft to replace the security info on your account. This is the last resort route. Start at the code prompt when you try to sign in, and select the option that says you do not have access to any of the methods listed.
Next, enter a new email address or phone number that you control now. Microsoft will send a code to that new address or number so you can prove you can reach it. After the wait, this contact replaces the old security info, so pick one you expect to keep and can check often, not a temporary address or a borrowed phone.
Expect checks based on account details you should know, such as your password and other information you gave when you set up the account, to check that the request came from you. Answer as fully and accurately as you can from memory. If you cannot remember your password either, use the separate account recovery page for that problem.
When you submit the request, write down the date you made it and the exact new email address or phone number you entered. Keep that note safe, and save the confirmation message Microsoft sends after you submit the request. Submitting the request starts the 30-day wait before the new security info takes over and the old info is removed.
If you find your old phone, or you regain access to a method already on the account, during the wait, do not start a new request. Open the confirmation message and use the cancellation link in it. Canceling stops the replacement, so you can sign in with the method you have back and keep your current security info.
What the 30-day wait means, and what it does not mean
The wait is there to slow down a thief. If someone stole your password and changed the email address or phone number on the account right away, they could receive every verification code themselves and lock you out. The 30 days give you time to see the confirmation message, recognize a request you did not make, and cancel it before the change happens. That delay protects the real owner.
The wait does not mean your account is being deleted. Your Microsoft account, your email, and your files in OneDrive stay in place while the days pass. Nothing is wiped at the end of the wait, either. When the 30 days are over, the new email address or phone number you gave takes the place of the old security info. The countdown changes contact details only.
Until then, the old security info stays on the account and the new contact cannot be used in its place yet. You also cannot make more changes to security info during the wait, such as adding another address or removing the old phone. That pause is part of the protection. It stops a string of quick changes before you have time to react. It lifts when the wait ends.
Write the end date on a calendar and keep it with the note you made of the request date and the new contact. Keep that new email inbox or phone working, and do not start a second replacement request. A second request can confuse which contact and date apply. If nothing changes, wait for the first request to finish on its date. Then use the new contact for your code.
Set up two-step verification on your new phone
Once you are signed in again, set up the new phone before you sign out anywhere else. Put the new phone beside a computer you trust, go to account.microsoft.com, open Security, and open the page for managing your sign-in methods. Add your new phone number, choose text or call, and enter the code Microsoft sends to confirm the number works.
Next, add the Microsoft Authenticator app from the same page. Install Authenticator on the new phone, select the option to add an app on the computer, and scan the QR code on screen with the phone. Then do a test sign-in in a different browser and approve it on the new phone before you rely on it.
Only after the test works should you remove the old phone. If you replaced it, delete the old number and the old app entry from the list on that page. Keep at least two working methods on the account, for example the new phone and a backup email address you check often. Check each method once before you close the page.
If the old phone was lost or stolen, do more than remove it. From the trusted computer, sign that phone out of your account and change your password. If someone else has already changed your account details, do not work through that clean-up here. Follow our separate guide to recovering a taken-over account instead. Then test the new phone again with the new password.
Add a spare way in so this does not happen again
Add a spare way in so this does not happen again
Save a fresh recovery code in two places away from your phone. Write it on paper and put it in a home file, and if you use a password manager, save it there too. Label it Microsoft recovery code, with today's date. Do not keep the only copy on the phone itself, because you lose that copy too if the phone is lost or replaced.
Build one habit from this experience. Whenever you get a new phone or a new number, update your Microsoft security info on the same day, while the old phone still works and can still receive a code. Do it before you trade in, sell, or wipe the old phone. Waiting until the old phone is gone turns a short update into a much harder job.
Run a final check before you stop. Your security info should list at least two working methods, your new phone should have passed a test sign-in, and the old phone should be removed. Your recovery code should be in its file, where a trusted family member could find it in an emergency. If any part fails, fix it now while you are still signed in.
Frequently asked questions
Will my email and OneDrive files be deleted during the 30-day wait?
No. The wait does not delete your Microsoft account, email, or OneDrive files. The new contact replaces the old security info when the 30 days end.
What should I do if I find my old phone during the 30-day wait?
Use the cancellation link in the confirmation message from your replacement request if you can reach a listed method again. Canceling stops the replacement, so your old security info stays in place.
Conclusion
A lost or replaced phone breaks one sign-in method. It does not end your Microsoft account. Work through the options in order, and use the slowest route only when the faster ones are closed to you.
Once you are back in, take the few minutes to leave yourself a second way in and a recovery code stored off the phone. Next time a phone is lost, replaced, or stops working, it will be a short detour instead of a long wait.