Lost your two-factor phone or codes keep failing

I lost my authenticator phone, or the 2FA codes are always rejected.

Sign in with one of your recovery codes; if codes are always rejected, the phone's clock is usually wrong.

Before you start: Your recovery codes (saved when you turned on two-factor), or your phone with the authenticator app.

Step by step

1. If codes are rejected: on the phone, turn on automatic date and time (Android: Settings > System > Date & time; iPhone: Settings > General > Date & Time > Set Automatically). In Google Authenticator you can also use "Time correction for codes".
2. Make sure you are reading the CoreX entry in the app, not another site's code, and type it before it changes.
3. If you lost the phone: on the sign-in page enter your email and password, then choose "Use a recovery code" and type one of your saved codes.
4. Once in, go to Security, turn two-factor off and on again to link your new phone, and save the new recovery codes (the old ones stop working).
5. If you have neither the phone nor any recovery code, contact support from the account email. Expect identity checks; this is slow on purpose, because it is exactly what an attacker would ask for.

Check it worked: You can sign in with a fresh code from the new phone.

Why it happens: Authenticator codes depend on the exact time, and a lost phone takes the app with it.

No phone and no recovery codes: contact support from your account email and be ready to prove ownership (for example, invoice numbers and the card brand and last four digits).

More guides on Account and login:

• Reset a forgotten password
• Verification code not arriving or rejected
• Sign in with Google, and set a password for SFTP
• Change your password or email address
• Turn on two-factor sign-in
• Cannot sign in: attempts limit, security check or mobile