PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
you cannot find your account recovery or backup codes when you need to sign in

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Pause before trying more codes. Use a trusted, already-signed-in device or the provider’s official recovery flow, and do not share passwords, codes, ID scans, or screen access with unofficial “helpers”.

Do not do these things

  • Don’t type your password into a link from an email, text, direct message, advert, or search result you were not expecting.
  • Don’t pay anyone claiming they can “unlock” the account, and don’t move the conversation to WhatsApp, Telegram, or social media messages.
  • Don’t keep guessing codes or recovery answers after a few failed attempts; repeated failures may make recovery harder or slower.
  • Don’t disable 2-step verification in a panic unless you are safely inside the official account settings and have another sign-in method ready.
  • Don’t hand over ID documents, selfies, payment details, or remote access unless you are sure you are inside the provider’s official recovery process.

What to do now

  1. Confirm you are on the real sign-in page.
    Open the app you normally use, or type the service’s address into your browser yourself. Do not use a login link from a message, advert, or unfamiliar support account.

  2. Check likely places once, for no more than a few minutes.
    Look in your password manager secure notes, downloads folder, files named “backup codes” or “recovery codes”, printed papers, notebook, screenshots folder, encrypted vault, cloud storage, and the correct user profile on shared computers. If you find codes stored somewhere unsafe, use them only if needed now and move them to safer storage later.

  3. Try an already-signed-in device before starting recovery.
    Check your phone app, tablet, another browser profile, or a trusted computer. If you are still signed in, go to the account’s security, sign-in, or 2-step verification settings and see whether you can add another sign-in method or generate new recovery or backup codes.

  4. Read the warning before creating new codes.
    Some services make old recovery or backup codes stop working when you create a new set. If the screen says this, save the new codes safely before closing the page.

  5. Use another verification option if one is offered.
    On the sign-in screen, look for wording such as “Try another way”, “Use a security key”, “Use your authenticator app”, “Use a trusted device”, “Verify by email”, or “Verify by phone”. Only use email or phone options you still control.

  6. If you cannot get in, start the provider’s official account recovery.
    Use the provider’s own “forgot password”, “can’t sign in”, or “account recovery” route. Give only information you genuinely know, such as previous passwords, account creation details, billing details for paid services, or recovery contact details. If you cannot answer, stop rather than guessing repeatedly, and try again from a trusted device or familiar network.

  7. If you get into the account, do a quick takeover check.
    Change the password to a unique one, review recent sign-in activity, sign out of devices you do not recognise, and check recovery email, recovery phone, trusted devices, app passwords, connected apps, and email forwarding rules.

  8. If money, fraud, or a scam is involved, use the right UK reporting route.
    Contact your bank or affected service through its official app, website, or phone number. In England, Wales, or Northern Ireland, report fraud or cyber crime through Report Fraud. In Scotland, report crime to Police Scotland on 101 unless it is an emergency. Suspicious emails can be forwarded to the UK Suspicious Email Reporting Service.

What can wait

  • You don’t need to rebuild your whole digital security setup right now.
  • You don’t need to decide today whether to change email provider, replace every device, or close the account.
  • You don’t need to perfect your long-term 2-step verification method before you regain safe access.
  • You don’t need to answer every alert at once; focus first on the account that can reset other accounts, usually your email.

Important reassurance

Losing recovery codes is common, and it often feels worse because it happens at the exact moment you need them. Slowing down, using trusted devices, and staying inside official recovery routes can reduce the chance of making the account easier to steal.

Scope note

These are first steps only: regain safe access if you can, avoid fake support, and check for signs of account takeover. Later decisions about wider security, fraud recovery, or business systems may need specialist help.

Important note

This is general information, not legal, financial, cyber security, or professional advice. If you think money is at risk, contact your bank or payment provider through official channels first.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us