Key takeaways
Never provide authentication codes or seed phrases.
A reset may trigger a temporary withdrawal hold.
If the old device is available
Add or migrate authentication in the security center before removing the old device. Save new recovery codes and review login alerts.
If the old device is unavailable
Use the official sign-in recovery flow and prepare identity and recent account records. Avoid search ads and direct-message links.
Distinguish migration, bad timing, and total loss
When the old device works, use the authenticator official transfer flow and verify every account on the new device before removing the old one. If codes fail, check automatic time and timezone before deleting the binding.
If the old device and recovery methods are unavailable, use the exchange official login or recovery flow. The platform may verify identity and recent activity and impose a withdrawal hold after changing security settings.
Scam signals during recovery
A legitimate recovery flow does not need your current password, seed phrase, wallet private key, or a complete one-time code, nor a transfer to a personal address. Treat remote-control and screen-sharing requests with extreme caution.
Enter only through a known official domain or app, not reset links in ads, texts, or direct messages. After recovery, review devices, API keys, email forwarding, and allowlists, then store new recovery information offline.
FAQ
Can someone reset it for me?
Do not hand account details, identity documents, or codes to third parties. Use only the official flow.
Does Authenticator migration always require the old phone?
Manual transfer generally needs the old device. Codes synced to a Google Account may appear after sign-in, but each exchange binding still needs verification.
Why can withdrawals be blocked after an authenticator reset?
Security changes can trigger a cooling period to reduce loss after account takeover. Use the timer shown in the account.
Where should recovery codes be stored?
Offline, somewhere you can reach long-term and separate from the phone: paper, or a secure note in a password manager. Do not screenshot them into a photo library, chat history, or mailbox, which are the first three places an attacker checks after taking over an account.
Sources and verification
Sources prioritize protocol, network, and exchange documentation. External pages can change; signed-in confirmation screens remain authoritative for fees and account status.