Lost Phone and Google 2-Step Verification: How to Get In

Your phone was stolen at the LRT station, dropped in a drain, or simply replaced, and now Google wants a code or a tap on a phone you no longer have. Gmail, Photos, YouTube and every app you open with "Sign in with Google" are waiting behind that one screen.

The short answer: the lost phone is rarely the only way in. Tap "Try another way" on the sign-in screen and Google lists every other second step you set up, such as backup codes, another signed-in device or a security key. If the phone was your only method, getting your old number onto a new SIM often solves it.

This guide covers each option on that screen, the SIM route for Malaysian numbers, what to do the moment you are back in, and what happens if nothing works. It is for personal Google Accounts; work and school accounts go through their administrator.

Last checked: 29 September 2026.

#What Should You Do If You Lost the Phone You Use for Google 2-Step Verification?

Tap "Try another way" when Google asks for your phone. Google's page on fixing common 2-Step Verification issues says you can verify with another phone signed in to your account, another number added to 2-Step Verification, a saved backup code, a hardware security key, or a passkey created on another device. If none exist, ask your carrier to transfer your number to a new SIM. Once in, sign the lost phone out and change your password. If every route fails, use account recovery and expect a wait. Nobody outside Google, including AwareXone, can switch off your 2-Step Verification.

#What Does Each Option on "Try Another Way" Need?

The list you see depends on what you set up before the phone went missing, so two people can see completely different screens. Google's Google prompts help page says that when your phone is lost, you tap "Try another way", then "I don't have my phone", then choose an option. Labels vary by app version, language and region; some screens say "I can't do this" instead.

#A Decision Guide: Which Route Is Still Open?

Work down this list and stop at the first yes.

• Is another computer, tablet or phone still signed in to your Google Account? Yes: use it for a Google prompt. No: next question.
• Did you ever print or download backup codes? Yes: use one. No: next question.
• Did you add a security key, a passkey or authenticator on another device, or a second number? Yes: pick it on "Try another way". No: next question.
• Does Google text the lost phone's number? Yes: get that number onto a new SIM. No: next question.
• Nothing left? Use account recovery from a familiar device and location, and plan for a wait of days.

#Using Backup Codes You Saved Earlier

Backup codes are the cleanest way back in. Google's backup codes page says you sign in, click "Try another way", choose "Enter one of your 8-digit backup codes" and type one you have not used. Each code becomes inactive after one use, so cross it off.

Cannot find them? Check where you keep your passport or IC. If you downloaded them, Google says the file is named Backup-codes-yourusername.txt, so search your computer for "Backup-codes". Codes saved only on the lost phone are gone with it.

#Another Signed-In Phone, Tablet or Computer

An old phone in a drawer can be worth more than any answer to a recovery question. Google's 2-Step Verification settings page says prompts arrive on Android phones signed in to your account and on iPhones with the Gmail, Google Photos, YouTube or Google app signed in. Charge the old device, connect it to Wi-Fi, and open one of those apps before you try to sign in on the new phone.

If you once ticked "Don't ask again on this computer" on your laptop, Google says you may be able to sign in there without a second step. Once in, you can change your verification methods from that laptop.

#Security Keys, Passkeys and Authenticator Apps

These only help if they were set up before the loss and do not live on the missing phone.

• Security key: plug it in or tap it when Google asks. Google's Advanced Protection FAQ says enrolled accounts must use a backup key, and that without one, recovery takes a few days.
• Passkey: Google's troubleshooting page says a passkey will not be offered if the device holding it has its screen lock turned off, or if "Skip password when possible" is off in your security settings.
• Authenticator app: Google's Authenticator help page says codes synced to your Google Account appear when you sign in to Authenticator on a new device. That sign-in needs your account first, so the sync helps most when Authenticator is already open on a second device, such as a tablet.

#Getting Your Old Number Onto a New SIM in Malaysia

If Google only ever texted your number, the number is the key, not the handset. Google's troubleshooting page says you can ask your carrier to transfer your phone number to a new phone or SIM card. The code then arrives on the new SIM.

1. Contact your carrier (Maxis, CelcomDigi, U Mobile, unifi Mobile, Yes or another) through its official app, website or store, and ask for a replacement SIM on your existing number. Bring the identification it asks for.
2. If the phone was stolen, ask whether the carrier wants a police report and can block the handset. Google's Find Hub page notes carriers can use the IMEI number to disable a device.
3. Once the new SIM has signal, request a fresh code. Google says only the newest code works.

If your phone suddenly shows "No service" while it is still in your hand, that is a different problem: someone may have moved your number. Our guide to SIM swap attacks in Malaysia covers that case.

#Once You Are Back In: Sign the Lost Phone Out and Lock It Down

The lost phone may still be signed in to Gmail, with prompts arriving on it. Do these in order:

1. Sign the lost phone out. Google's page on devices with account access says to go to your Google Account, tap "Security & sign-in", then "Manage all devices" under "Your devices", pick the phone and tap "Sign out". Sign out every session with that device name.
2. Change your Google Account password, as Google recommends for a lost or stolen phone.
3. Remove any passkey created on the lost phone, then remove it as a 2-Step Verification phone or security key if it was one.
4. If the phone was lost with backup codes saved on it, open the 2-Step Verification settings and create a new set. Google says the old set stops working when you do.
5. If Google Authenticator was on the lost phone with codes not synced, Google says you need to visit each site that uses it, remove the old codes and link the new device.
6. Locate, lock or erase the phone. For Android, Google's Find Hub help page covers "Play sound", "Mark as lost" and "Factory reset" from another device or the web. For an iPhone, Apple's Find My guide covers Lost Mode and erasing it at icloud.com/find.

#If Nothing Works: Account Recovery and the Waits

When no second step is left, the Google account recovery page is the route. Google says wrong guesses won't kick you out and there is no limit on recovery attempts. For accounts with 2-Step Verification and no other second step, its troubleshooting page says it can take 3 to 5 business days for Google to make sure it's you.

• Use a device, browser and location where you normally sign in, as Google's recovery tips advise. Home Wi-Fi on your usual laptop beats a borrowed phone at the office.
• Answer every question with your best guess rather than skipping it.
• Give an email address you can check now, and watch its spam folder for a message titled "Your Google support inquiry".
• If you recently changed recovery details, Google says changes can take up to 7 days to take effect, so try again in a few days.

If Google replies that it could not confirm the account is yours, our guide to what "Google couldn't verify this account belongs to you" means explains how to retry. Google alone decides, and some accounts cannot be recovered; its own fallback is a new account. The wider picture, across platforms, is in our piece on recovering accounts after losing your phone, email or 2FA.

#Mistakes That Keep People Locked Out Longer

• Factory resetting the lost phone while it was the last device able to receive a prompt.
• Trying recovery from a new phone, a VPN or a café network instead of your usual computer.
• Expecting a newly added number to work at once. Google says a new 2-Step Verification number may take up to 7 days to be trusted.
• Buying a new number instead of reclaiming the old one from your carrier.

#If the Phone Was Stolen or You Lost Money in Malaysia

A stolen, unlocked phone can reach banking apps and e-wallets as well as Gmail. If money has moved, the government's NSRC 997 page says to call 997 within 24 hours of discovering the scam so accounts and transactions can be blocked, contact your bank, and make a police report at the nearest police station.

If you typed your Google password or a code into a fake login page, report it to CyberSecurity Malaysia's Cyber999 service by online form, email, phone or its app.

#Set-Up Checklist So a Lost Phone Never Locks You Out Again

• Print a fresh set of backup codes and keep them with your passport or IC, not on your phone.
• Add a second method that lives off your main phone: a security key, a passkey on your laptop, or a second number.
• Keep an old phone or tablet signed in at home so it can receive Google prompts.
• Check your recovery phone and email on Google's recovery options page. Google says a recovery phone should get texts, belong only to you and stay with you.
• Add a trusted recovery contact if Google offers it in your region. Google says there is a 7-day period after they accept before they can help.
• Sync Google Authenticator to your account, or export its codes before changing phones.

#When a Case Review Makes Sense

Most people get back in with the steps above, and only Google can approve a recovery. A second opinion helps when the account runs a business or a YouTube channel, or when a lost phone and a hack are tangled together. SocialSafe by AwareXone, AwareXone's recovery service, is independent of Google and uses only Google's own processes. We check what you have tried and tell you honestly whether another attempt is worth it; sometimes the answer is to wait out the 7 days and try once more from your home laptop. Our account security service explains the review, and our Trust Center lists what we will never ask for, starting with your password and codes.

#Frequently Asked Questions