People buy a new phone for the camera and the screen, then trip over the authenticator app. Passwords move themselves if they live in a manager. The second factor does not: the codes are computed from a secret key that exists only on the old device.
Here is what to do before selling the old phone, and what is left if it is already gone.
Qué hacer mientras el teléfono antiguo funciona
-
List everything protected by a second factor
Open the authenticator app and write down every entry. There are usually more than you remember: email, banking, a work account, social media, an exchange, a hosting panel.
-
Download the backup codes
Every service has a list of one-time codes in its security settings. That is the only way in when the app is gone. Keep them in a password manager — it syncs between devices and survives a lost phone.
-
Move the authenticator
Apps with cloud sync only need you to sign in on the new phone. The others offer a QR transfer: the old phone shows a code and the new one reads it.
If the app can do neither, you will have to switch the second factor off and on again for each service, from the new device.
-
Test logging in from the new phone
For every item on the list: sign out and sign back in. While the old phone is at hand a mistake costs five minutes; after the wipe it costs a week of support tickets.
-
Update the linked number
If the SIM card changes too, update the number in the services before the old one stops working — banking above all.
-
Only now wipe the old phone
A full factory reset, not manual deletion of apps. And sign out of the manufacturer account, or the device stays tied to you.
Cómo se comporta cada método al cambiar de móvil
| Método | Qué ocurre al cambiar de móvil | Qué preparar antes |
|---|---|---|
| SMS code | Works if the number stays; a new number means lost access | Update the number before the old one is cut off |
| App with cloud sync | Moves by signing into the account | Remember the password to the app itself |
| App without cloud | Needs a QR transfer or manual re-enrolment | Backup codes and time for the transfer |
| Hardware key | Nothing changes — the key is not in the phone | A second key in case the first is lost |
| Passkey | Moves with the ecosystem account | Check that syncing is enabled |
Si ya has perdido el teléfono
Unpleasant but not hopeless. The order is the same as with a suspected hack: email first, everything else after.
-
Sign in with backup codes
If you saved them, this is where it ends. Sign in, remove the old second factor, add the new one.
-
Check trusted devices
A computer where you are already signed in often counts as trusted and lets you in without a code. That is a chance to recover without support — use it without ending the session.
-
Block the SIM card
While a stranger holds the number, every SMS code goes to them. Calling the operator is the first action, not the last.
-
Recovery through support
The long road: documents, questions, waiting. Be ready for some services never to come back — especially those with neither backup codes nor a linked number.
Cómo es un cambio bien preparado
- The authenticator stayed on the wiped phone
- Backup codes were a screenshot in that phone’s gallery
- Support recovery for every single service
- Some accounts are lost for good
- Codes in the password manager, reachable from any device
- The authenticator moved and tested before the wipe
- The number updated in critical services in advance
- The move takes half an hour and goes unnoticed
How the confirmation methods work and why an app beats SMS is covered in the article on two-factor authentication.