The Hidden Headache of Moving 2FA to Your New Phone

The Hidden Headache of Moving 2FA to Your New Phone

Two-factor authentication (2FA) is brilliant for keeping your accounts secure. It’s that extra step — usually a time-based code from an authenticator app — that makes life much harder for hackers.

The problem is that moving 2FA codes can be a real headache when you get a new phone.

Why It’s Not as Simple as You Think

Most of us upgrade our phone, transfer photos and apps, and get back to business. But if you use an authenticator app, you might be in for a surprise. Those codes aren’t tied to your online account — they’re tied to the phone itself.

That’s on purpose. If the codes were stored with your account, a data breach could give someone both your password and your 2FA code. By keeping them device-based, it’s far harder for an attacker to steal them… but it also makes it harder for you to move them.

And it gets trickier:

  • Switching between iPhone and Android? You can’t just copy your codes over.
  • Even moving iPhone-to-iPhone or Android-to-Android needs preparation.
  • Some apps, like Microsoft Authenticator, make transfers clunky. Others, like Google Authenticator, can be a bit easier — but you still need to plan ahead.

How to Make It Easier Next Time

Before you switch phones:

  1. List all the accounts you’ve protected with 2FA.
  2. Check transfer options for your authenticator app — some allow exports, others don’t.
  3. Have backup methods ready (like recovery codes) in case something goes wrong.
  4. Work with your IT team if your work accounts are protected — you may need them to re-register your device.

Looking Ahead: Passkeys and Passwordless

The move towards passkeys and passwordless logins will make this even more device-dependent. Passkeys are bound to your physical device, so to move them you’ll need to re-register with your IT team or service provider.

The bottom line? Device-based security makes accounts safer, but you need to plan before you upgrade your phone — otherwise you could spend hours chasing down logins you didn’t realise were locked to your old device.