PanicStation.org
UK USA
us Technology & digital loss lost security key • lost yubikey • lost titan key • lost fido2 key • lost u2f key • hardware 2fa key missing • security key stolen • misplaced security key • cannot log in without key • locked out of account • two factor key lost • passkey on security key • passwordless key login • work account security key lost • google security key lost • microsoft security key lost • remove security key from account • recovery codes missing • second factor device lost • security key revoked

What to do if…
you lose a physical security key used for two-factor sign-in

Short answer

Treat the missing key as potentially in someone else’s hands: use another sign-in method to remove it from each account it protects, and notify your employer’s IT/security team right away if it was for work.

Do not do these things

  • Don’t delay removing the key “until you search everywhere” if it may have been lost outside your control.
  • Don’t turn off multi-factor security entirely as the immediate fix; remove the lost key and keep another second step active.
  • Don’t keep retrying logins if you’re locked out (you can trigger lockouts and make recovery harder).
  • Don’t share backup/recovery codes or security screenshots with anyone who contacts you first.
  • Don’t register a replacement key from an untrusted seller because you feel rushed.

What to do now

  1. Make a quick risk call: “probably at home” vs “lost/stolen.”
    If it was lost in a public place, rideshare, airport, office, gym, etc., treat it as lost/stolen and act immediately.

  2. Write a 60-second list of the accounts that key could unlock.
    Start with: your primary email, your password manager, any work/school single sign-on, banking/finance, cloud storage, and any account that can reset others.

  3. Get into your primary email account using any other available second step.
    Use what you already have (backup security key, authenticator app, SMS/voice if enabled, recovery codes, or another registered passkey).
    A security key usually isn’t enough by itself without your password or device unlock — but if you set up passwordless/passkeys on that key for any service, treat this as higher risk and move fast.

  4. Remove the missing security key from that account right away.
    In the account’s security settings (often “2-Step Verification,” “Security key,” “Passkeys,” or “Security info”), delete/remove the entry for the lost key.

  5. Sign out of other sessions and change the password for the account you just secured.
    Use “Sign out of all devices” (or similar), then change the password — especially if the key was lost with anything that could reveal your password or unlock your devices.

  6. Repeat key removal for every account on your list (highest-impact first).
    Prioritize: password manager, email, financial accounts, cloud storage, workplace SSO, developer platforms, and anything used for account recovery.

  7. If it’s a work/school key, contact your IT/security team or helpdesk immediately.
    Ask them to revoke/remove the security key (FIDO2) credential, review recent sign-ins, and issue the approved replacement process.
    Use your organization’s official support channels (intranet/help portal/known number), not contact details sent by text/email.

  8. If you’re fully locked out, use the provider’s official account-recovery process.
    Look for “Try another way,” “Can’t use your security key,” or “Account recovery.” If you’re stuck, use the provider’s official support.

What can wait

  • Ordering and enrolling a replacement key (do it after the missing one is removed).
  • Making your setup “perfect” (extra keys, reorganizing everything).
  • Auditing every single account immediately (secure the critical ones now; others can follow).
  • Deciding whether the incident “counts” as theft — your priority is removing the key and securing access.

Important reassurance

Most harm is prevented by one fast action: removing the missing key from your accounts. Once it’s removed everywhere it was registered, that lost key should no longer be accepted for those accounts.

Scope note

These are first steps to stabilize access and reduce immediate risk. Later, you can improve resilience (like adding a backup key and storing recovery codes safely).

Important note

This is general information, not legal, financial, or professional IT advice. Exact steps vary by provider and organization. Follow official recovery and security guidance for each service, and your workplace’s established IT/security process.

Additional Resources
Support us