Your phone was in your pocket when you got on the bus. It is not in your pocket now. Along with the photos and the phone numbers, it feels like your whole online life just rode away without you.
Losing your phone can also mean losing access to texted codes, an authenticator app, saved passwords, or passkeys. That is why recovery must be prepared before the bad day. Use the 3-2-1 recovery rule: three ways back in, two places to keep them, and one plan for the bad day.
This plan only exists if you build it before you need it. Aim for three possible ways back into important accounts. Keep the recovery information in two safe places, with at least one place away from your phone. Then know the one plan you will follow if a device disappears.
Give your main account a recovery email address or phone number that you could still reach if your main phone disappeared. Keep it current and check it occasionally. An unused recovery account that you cannot remember how to enter is not much of a rescue.
Record how to retrieve your most important passwords in the My Password Tracker page of your DOORS Password Toolkit. Use long, different passwords and update the page when they change. Store it with important papers, away from the devices it helps you recover. If you use hints, make sure another person could not easily solve them.
When you turn on MFA, many accounts offer a list of single-use backup codes. Each code works once, in place of the code your lost phone can no longer provide. Print or copy the list and keep it with your Toolkit.
No printer? Copy the codes by hand into your Password Toolkit. A pen never runs out of toner. You can also save them as a PDF, as long as it lives somewhere that is not the phone you are protecting yourself against losing, like a home computer.
Learn whether your authenticator app and passkeys synchronize, can be transferred, or need another signed-in device. Keep backup codes either way. Never photograph or casually share the QR code used to set up an authenticator app.
The phone is gone and the plan exists. A trusted friend's or family member's computer is best. A community-centre or library computer may help when nothing else is available, but public computers are not completely private or trustworthy. The computer itself is ordinary. Your preparation is what makes recovery possible.
Open a private browsing window. It is usually called Private or Incognito. This reduces what the browser saves after every private window is closed, but it does not make a public computer completely safe. Never choose “remember me” or “trust this computer.”
Sign in to your main email account with your password, from your head or your Password Toolkit. Your email is the master key: it is the account that can reset all the others.
If it asks for a code from your lost phone, look for a link like "Try another way" or "Use a backup code." Type one code from your printed or hand-copied list, or use your recovery email.
Once you are in, go to your account's security page. Sign the lost phone out, remove or replace its authentication methods, and review recent activity. Change important passwords if the phone or account may have been accessed.
Protect the phone and finish safely. Use the phone's lost-device service to lock or erase it when possible, and contact your mobile provider to suspend the SIM. Then sign out of every account, close all private windows, and delete any files you downloaded.
Time to run the drill. Your phone was stolen on the bus this morning. Walk through what happens next.
You have all the pieces now. See them side by side, then collect your certificate. Continue to Putting it together.